U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

97–568PDF 2016

IS THE OPM DATA BREACH 

THE TIP OF THE ICEBERG? 

JOINT HEARING 

BEFORE THE

SUBCOMMITTEE ON OVERSIGHT & 

SUBCOMMITTEE ON RESEARCH AND TECHNOLOGY 

COMMITTEE ON SCIENCE, SPACE, AND 

TECHNOLOGY 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

FIRST SESSION 

July 8, 2015 

Serial No. 114–28 

Printed for the use of the Committee on Science, Space, and Technology 

( 

Available via the World Wide Web: http://science.house.gov 
(II) 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY 

HON. LAMAR S. SMITH, Texas, Chair 

FRANK D. LUCAS, Oklahoma 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

DANA ROHRABACHER, California 

RANDY NEUGEBAUER, Texas 

MICHAEL T. MCCAUL, Texas 

MO BROOKS, Alabama 

RANDY HULTGREN, Illinois 

BILL POSEY, Florida 

THOMAS MASSIE, Kentucky 

JIM BRIDENSTINE, Oklahoma 

RANDY K. WEBER, Texas 

BILL JOHNSON, Ohio 

JOHN R. MOOLENAAR, Michigan 

STEVE KNIGHT, California 

BRIAN BABIN, Texas 

BRUCE WESTERMAN, Arkansas 

BARBARA COMSTOCK, Virginia 

DAN NEWHOUSE, Washington 

GARY PALMER, Alabama 

BARRY LOUDERMILK, Georgia 

RALPH LEE ABRAHAM, Louisiana 

EDDIE BERNICE JOHNSON, Texas 

ZOE LOFGREN, California 

DANIEL LIPINSKI, Illinois 

DONNA F. EDWARDS, Maryland 

SUZANNE BONAMICI, Oregon 

ERIC SWALWELL, California 

ALAN GRAYSON, Florida 

AMI BERA, California 

ELIZABETH H. ESTY, Connecticut 

MARC A. VEASEY, Texas 

KATHERINE M. CLARK, Massachusetts 

DON S. BEYER, JR., Virginia 

ED PERLMUTTER, Colorado 

PAUL TONKO, New York 

MARK TAKANO, California 

BILL FOSTER, Illinois 

SUBCOMMITTEE ON RESEARCH AND TECHNOLOGY

HON. BARBARA COMSTOCK, Virginia, Chair 

FRANK D. LUCAS, Oklahoma 

MICHAEL T. MCCAUL, Texas 

RANDY HULTGREN, Illinois 

JOHN R. MOOLENAAR, Michigan 

BRUCE WESTERMAN, Arkansas 

DAN NEWHOUSE, Washington 

GARY PALMER, Alabama 

RALPH LEE ABRAHAM, Louisiana 

LAMAR S. SMITH, Texas 

DANIEL LIPINSKI, Illinois 

ELIZABETH H. ESTY, Connecticut 

KATHERINE M. CLARK, Massachusetts 

PAUL TONKO, New York 

SUZANNE BONAMICI, Oregon 

ERIC SWALWELL, California 

EDDIE BERNICE JOHNSON, Texas 

SUBCOMMITTEE ON OVERSIGHT

HON. BARRY LOUDERMILK, Georgia, Chair 

F. JAMES SENSENBRENNER, JR., 

Wisconsin 

BILL POSEY, Florida 

THOMAS MASSIE, Kentucky 

BILL JOHNSON, Ohio 

DAN NEWHOUSE, Washington 

LAMAR S. SMITH, Texas 

DON BEYER, Virginia 

ALAN GRAYSON, Florida 

ZOE LOFGREN, California 

EDDIE BERNICE JOHNSON, Texas 
(III) 

C O N T E N T S 

July 8, 2015 

Page 

Witness List ............................................................................................................. 2 

Hearing Charter ...................................................................................................... 3 

Opening Statements 

Statement by Representative Barbara Comstock, Chairwoman, Subcommittee 

on Research, Committee on Science, Space, and Technology, U.S. House 

of Representatives ................................................................................................ 7 

Written Statement ............................................................................................ 8 

Statement by Representative Daniel Lipinski, Ranking Minority Member, 

Subcommittee on Research, Committee on Science, Space, and Technology, 

U.S. House of Representatives ............................................................................ 9 

Written Statement ............................................................................................ 11 

Statement by Representative Barry Loudermilk, Chairman, Subcommittee 

on Oversight, Committee on Science, Space, and Technology, U.S. House 

of Representatives ................................................................................................ 12 

Written Statement ............................................................................................ 13 

Statement by Representative Donald S. Beyer, Jr., Ranking Minority Member, Subcommittee on Oversight, Committee on Science, Space, and Technology, U.S. House of Representatives ............................................................... 14 

Written Statement ............................................................................................ 16 

Statement by Representative Lamar S. Smith, Chairman, Committee on 

Science, Space, and Technology, U.S. House of Representatives ..................... 17 

Written Statement ............................................................................................ 18 

Witnesses: 

Mr. Michael R. Esser, Assistant Inspector General for Audits, Office of Personnel Management 

Oral Statement ................................................................................................. 19 

Written Statement ............................................................................................ 22 

Mr. David Snell, Director, Federal Benefits Service Department, National 

Active and Retired Federal Employees Association 

Oral Statement ................................................................................................. 33 

Written Statement ............................................................................................ 35 

Dr. Charles Romine, Director, Information Technology Laboratory, National 

Institute of Standards and Technology 

Oral Statement ................................................................................................. 42 

Written Statement ............................................................................................ 44 

Mr. Gregory Wilshusen, Director, Information Security Issues, U.S. Government Accountability Office 

Oral Statement ................................................................................................. 50 

Written Statement ............................................................................................ 52 

Discussion ................................................................................................................. 78 

Appendix I: Answers to Post-Hearing Questions 

Mr. Michael R. Esser, Assistant Inspector General for Audits, Office of Personnel Management ............................................................................................. 96 
Page

IV 

Mr. David Snell, Director, Federal Benefits Service Department, National 

Active and Retired Federal Employees Association .......................................... 100 

Dr. Charles Romine, Director, Information Technology Laboratory, National 

Institute of Standards and Technology .............................................................. 105 

Appendix II: Additional Material for the Record 

Statement by Representative Eddie Bernice Johnson, Ranking Member, Committee on Science, Space, and Technology, U.S. House of Representatives .... 112 

Letter submitted by Representative Barbara Comstock, Chairwoman, Subcommittee on Research, Committee on Science, Space, and Technology, 

U.S. House of Representatives ............................................................................ 113 
(1) 

IS THE OPM DATA BREACH 

THE TIP OF THE ICEBERG? 

WEDNESDAY, JULY 8, 2015 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON RESEARCH AND TECHNOLOGY & 

SUBCOMMITTEE ON OVERSIGHT, 

COMMITTEE ON SCIENCE, SPACE, AND TECHNOLOGY, 

Washington, D.C. 

The Subcommittees met, pursuant to call, at 3:36 p.m., in Room 

2318 of the Rayburn House Office Building, Hon. Barbara Comstock [Chairwoman of the Subcommittee on Research and Technology] presiding. 
2 
3 
4 
5 
6 
7 

Chairwoman COMSTOCK. The Subcommittees on Research and 

Technology and Oversight will come to order. Without objection, 

the Chair is authorized to declare recesses of the Subcommittees at 

any time. 

Good afternoon. Our apologies for the delay. As you saw or 

heard, we were voting. 

Welcome to today’s hearing entitled ‘‘Is the OPM Data Breach 

the Tip of the Iceberg?’’ In front of you are packets containing the 

written testimony, biographies, and truth-in-testimony disclosures 

for today’s witnesses. 

I now recognize myself for five minutes for an opening statement. 

Just over a month ago, the Office of Personnel Management 

(OPM) announced a massive data breach that exposed the personal 

information of over 4 million current and former federal employees 

and contractors. Like thousands of my fellow constituents and people across the country, I received a letter from OPM informing me 

that my personal information may have been compromised or stolen by criminals who are behind this attack. 

Unfortunately, the news appears to be getting worse this week 

as we learn more about the reported second OPM data breach, 

compromising the security of potentially 18 million federal employees, contractors, and others who submitted sensitive information 

for background checks to the government. And sadly, the response 

from OPM has not inspired confidence over the past few weeks. 

Identity theft by what seems to be a foreign entity is a very serious national security threat. They are literally, you know, at cyber 

war with us, and we as leaders have to appreciate that reality and 

operate in that reality. 

Many of my constituents have contacted me about their fears and 

concerns. It has been months since OPM discovered the attack, and 

we still have too many questions and not enough answers. As we 

will hear from some of our witnesses today, federal employees have 

many unanswered questions. For example, just one: Are the credit 

monitoring identity theft provisions adequate? I know we’ve heard 

from people who are very concerned about whether they are. 

Most alarming to me about these breaches is that they were 

launched less than 18 months after a previous severe network assault on OPM. We know that information security incidents reported by federal agencies has increased by 1,000 percent since 

2006, 1,000 percent increase. 

For years the OPM Office of Inspector General and the U.S. Government Accountability Office have been warning OPM leadership 

of critical vulnerabilities to their information systems. Some of the 

weakness and current problems were ID’d as far back as 2007. 

Today, many of their recommendations for fixing the systematic 

failures remain unmet. 

Cyber criminals and foreign enemies are working night and day 

with the latest technology to exploit every vulnerability in our system, and it appears we’re behind the times. The United States has 

some of the world’s best technological minds and resources, yet our 

management in OPM does not appear to be getting up to speed. 

Federal employees provide their sensitive personal information 

under the expectation that it is protected with all the seriousness 
8 

that it should receive. However, that trust has now been broken 

and hence so many concerns. 

Cybersecurity has to be a top priority in every government agency from the top Cabinet official on down. We need an aggressive, 

nimble, and flexible strategy to anticipate, intercept, and stop these 

cyber attacks. Those who are engaging in the attacks on our citizens, agencies, and companies, whether they be nation states, adversaries, or hacktivists and just, you know, random criminals are 

a reality that we’ll be living with in the 21st century and we must 

develop and use all the tools and technology available to thwart 

them and understand this is going to be an ongoing problem that 

we have to constantly adapt to. 

I want to note that we invited the OPM Chief Information Officer 

Donna Seymour to testify at today’s hearing. She declined the 

Committee’s invitation, citing other commitments, and we will continue to be working with them and asking them additional questions. 

Today’s panel of witnesses will help us better understand the 

magnitude of cybersecurity challenges at OPM across the federal 

government, as well as determine what steps need to be taken to 

prevent future cyber attacks and the state-of-the-art best practices 

to do so. And I should note that in the coming weeks we will also 

be looking at a lot of the best practices that the private sector has 

and other experts want to bring to bear that will probably reflect 

a lot of what you are going to be talking about today. 

I appreciate the leadership of Chairman Lamar Smith on these 

issues and the role the Science Committee—that they have played 

in making cybersecurity research and development a priority. 

I look forward to continuing to work on the Subcommittee on efforts to make sure the federal government is staying ahead of our 

adversaries. And if officials neglected their duties or are not the 

right people for the job, we also need to hold them accountable and 

make sure we are doing everything to improve the situation. 

[The prepared statement of Chairwoman Comstock follows:] 

PREPARED STATEMENT OF SUBCOMMITTEE ON RESEARCH & TECHNOLOGY

CHAIRWOMAN BARBARA COMSTOCK

Just over a month ago the Office of Personnel Management (OPM) announced a 

massive data breach that exposed the personal information of over 4 million current 

and former federal employees and contractors. 

Like thousands of my fellow constituents, I received a letter from OPM informing 

me that my personal information may have been compromised or stolen by the 

criminals behind this attack. 

Unfortunately, the news gets worse this week, as we learn more about the reported second OPM data breach, compromising the security of 18 million federal employees, contractors and others who submitted sensitive information for background 

checks. And sadly the response from OPM has not inspired confidence. 

Identity theft by what seems to be a foreign entity is a very serious national security issue. They are at cyberwar with us—do our leaders appreciate that reality? 

Many of my constituents have contacted me about their fears and concerns. It has 

been months since OPM discovered the attack, and we still have too many questions 

and not enough answers. 

As we will hear from witnesses today, federal employees have many unanswered 

questions. Just one: Are the credit monitoring identity theft provisions adequate? 

Most alarming to me about these breaches is that they were launched less than 18 

months after a previous severe network assault on OPM. We know that information 
9 

security incidents reporting by federal agencies has increased by 1000 percent since 

2006. 

For years the OPM Office of Inspector General and the U.S. Government Accountability Office have been warning OPM leadership of critical vulnerabilities to their 

information systems. Some of the weakness and current problems were ID’d as far 

back as 2007. Today, many of their recommendations for fixing the systematic failures remain unmet. 

Cyber criminals and foreign enemies are working night and day with the latest 

technology to exploit every vulnerability in our system, while OPM is behind the 

times and operating apparently at a pace with systems designed for the last century 

not for the current threat. The United States has some of the world’s best technological minds and resources, yet OPM’s management is failing. 

Federal employees provide their sensitive personal information under the expectation that it is protected with all due seriousness. However, the trust between our 

federal employees, contractors, and others whose information has been compromised 

is damaged. 

Cybersecurity must be a top priority in every government agency from the top 

Cabinet official on down. We need an aggressive, nimble, and flexible strategy to 

anticipate, intercept, and stop cyberattacks. 

Those who are engaging in cyberattacks on our citizens, agencies, and companies—whether they be nation states, adversaries or hacktivists—are a reality we 

will be living with in the 21st century and we must develop and use all the tools 

and technology available to thwart them and understand this is an ongoing problem 

we have to constantly be on top of. 

I want to note that we invited the OPM Chief Information Officer Donna Seymour 

to testify at today’s hearing. She declined the Committee’s invitation, citing other 

commitments, we continue to have questions about how and why this cyberattack 

occurred and the measures that have been instituted to prevent a future attack at 

OPM. We will take any necessary steps to ensure my constituents get those answers. 

Today’s panel of witnesses will help us better understand the magnitude of cybersecurity challenges at OPM and across the federal government, as well as determine 

what steps need to be taken to prevent future cyberattacks, and the state of the 

art best practices to do so. 

I appreciate the leadership of Chairman Lamar Smith on these issues and the 

role the Science Committee has played in making cybersecurity R&D a priority. 

I look forward to continuing to lead the Research & Technology Subcommittee in 

efforts to make sure the federal government is staying ahead of our adversaries who 

are constantly developing new and sophisticated malicious technologies. 

If officials neglected their duties, or are not the right people for the job, they must 

be held accountable so that proper leadership is in place to not just meet, but anticipate and beat the next cyber threat. 

Chairwoman COMSTOCK. So with that I will yield to the Ranking 

Member, but I also ask unanimous consent to place into the record 

various letters and articles that are relevant to the hearing. 

[The information appears in Appendix II] 

Chairwoman COMSTOCK. And without objection I’ll now yield to 

the Ranking Member. 

Mr. LIPINSKI. Thank you, Chairwoman Comstock. I want to 

thank you, Chairman Loudermilk, Chairman Smith, for holding 

this hearing on the recent OPM data breach. I want to thank all 

of our witnesses for being here this afternoon. 

Unfortunately, major cyber attacks are happening more frequently. Today, we’re going to talk about the significant breaches 

at the Office of Personnel Management. I have not received notification, but I believe I may have been a victim of this. But we all 

know that—I don’t want to take away the significance of it but it’s 

important to note there have been increasing number of cyber attacks in both the private and public sector where I know I’ve definitely been a victim of some of these attacks. 

Several years ago, I began working on cybersecurity legislation, 

the Cybersecurity Enhancement Act, with my colleague Mr. 
10 

McCall. Our legislation dealt with cybersecurity standards, education, and workforce development. When we started, I said that 

I had no doubt that threats from individual hackers, criminal syndicates, and even other governments would grow and evolve along 

with our increased use of the internet. Unfortunately, I was right. 

In February, Anthem, one of the Nation’s largest health insurance companies, announced it suffered a cyber breach that compromised the records of 80 million current and former customers. 

And just last year, there were high-profile breaches at J.P. Morgan 

Chase, eBay, Target, and many others affecting millions of people. 

Although I was happy that my bill with Mr. McCall was enacted 

at the end of last Congress, there is much, much more to do in the 

area of cybersecurity. Cybercrime and cyber espionage continue to 

threaten our national security, our critical infrastructure, businesses of all sizes, and every single American. This latest data 

breach at OPM is just another example of that. 

In the OPM breach, millions of federal employees’ personal information has been compromised, leading to significant concerns 

about how the stolen information will be used. Additionally, since 

OPM conducts more than 90 percent of all security clearance background investigations, this breach is an example of how cyber attacks threaten our national security. We must do better. 

It’ll take a collective effort in both the public and private sector 

to improve cybersecurity, and I cannot emphasize enough the importance of research into the social and behavioral aspects in this 

area. Our IT infrastructure is built, operated, and maintained by 

humans from the average worker at her desktop to Chief Information Officer of a major company or agency. Most cyber attacks are 

successful because of human error such as unwittingly opening a 

malicious email or allowing one’s credentials to be compromised. 

Understanding the human element is necessary to combat threats 

and reduce risks. 

To set governmentwide guidelines protecting federal information 

security systems, Congress passed—if I can turn my page—an example of human error here. Congress passed the Federal Information Security Modernization Act, or FISMA. FISMA, which was updated at the end of last Congress, requires federal agencies to develop, document, and implement an agencywide information security program. 

Along with being responsible for their own information security 

system, the National Institute of Standards and Technology is 

tasked with developing standards and guidelines for all civilian 

federal information systems. Since NIST plays a critical role in protecting our nation’s information security systems, it’s important 

that they be part of this conversation. I’m happy that Dr. Romine 

is here today to tell us more about how NIST develops FISMA 

standards and how they work with other federal agencies. 

FISMA also requires annual reviews of individual agencies’ information security programs, as well as reviews of information security policies in the implementation of FISMA requirements governmentwide. I hope to hear from our witnesses about the steps necessary to ensure that OPM meets FISMA requirements, as well as 

how other agencies are doing in this space. 
11 

More information security systems, both in the public and private sector, will surely be subject to cyber attacks in the future, 

and while it’s impossible to completely protect the connected information security system, we must do all we can to protect the personal information of millions of Americans and conduct the oversight to ensure such steps are taken. This hearing is the beginning 

of a conversation on how we can do that, and we must make sure 

that we follow through with action. 

I look forward to our discussion this afternoon. Thank you, and 

I yield back the balance of my time. 

[The prepared statement of Mr. Lipinski follows:] 

PREPARED STATEMENT OF SUBCOMMITTEE

MINORITY RANKING MEMBER DANIEL LIPINSKI

Thank you Chairwoman Comstock and Chairman Loudermilk for holding this 

hearing on the recent OPM data breach. I want to thank all the witnesses for being 

here this afternoon. 

Unfortunately, major cyber-attacks are happening more frequently. Today, we are 

going to talk about the significant breaches at the Office of Personnel Management 

(OPM). Not to take away from the significance of the OPM breach, I think it is important to note that there have been an increasing number of cyber-attacks in both 

the private and public sector. 

Several years ago I began working on cybersecurity legislation, the Cybersecurity 

Enhancement Act, with my colleague, Mr. McCaul. Our legislation dealt with cybersecurity standards, education, and workforce development. When we started, I said 

that I had no doubt that threats from individual hackers, criminal syndicates, and 

even other governments would grow and evolve along with our increased use of the 

internet. Unfortunately, I was right. 

In February, Anthem, one of the nation’s largest health insurance companies, announced that it suffered a cyber-breach that compromised the records of 80 million 

current and former customers. And just last year there were high profile breaches 

at JP Morgan Chase, eBay, Target, and many others affecting millions of people. 

Although I was happy that my bill with Mr. McCaul was enacted at the end of 

last Congress, there is much, much more to be done in the area of cybersecurity. 

Cybercrime and cyber- espionage continues to threaten our national security, our 

critical infrastructure, businesses of all sizes, and every single American. This latest 

data breach at OPM is just another example of that. In the OPM breach, millions 

of federal employees’ personal information has been compromised, leading to significant concerns about how the stolen information will be used. Additionally, since 

OPM conducts more than 90 percent of all security clearance background investigations, this breach is an example of how cyber-attacks threaten our national security. 

We must do better. 

It will take a collective effort of both the public and private sector to improve cybersecurity, and I cannot emphasize enough the importance of research into the social and behavioral aspects in this area. Our IT infrastructure is built, operated and 

maintained by humans, from the average worker at her desktop to the chief information officer of a major company or agency. Most cyber-attacks are successful because of human error, such as unwittingly opening a malicious email or allowing 

one’s credentials to be compromised. Understanding the human element is necessary to combat threats and reduce risk. 

To set government-wide guidelines for protecting federal information security systems, Congress passed the Federal Information Security Modernization Act or 

FISMA. FISMA, which was updated at the end of last Congress, requires federal 

agencies to develop, document, and implement an agency wide information security 

program. 

Along with being responsible for their own information security system, the National Institute of Standards and Technology (NIST) is tasked with developing 

standards and guidelines for all civilian federal information systems. Since NIST 

plays a critical role in protecting our nation’s information security systems, it is important that they be part of this conversation. I am happy that Dr. Romine is here 

today to tell us more about how NIST develops FISMA standards and how they 

work with other federal agencies. 
12 

FISMA also requires annual reviews of individual agencies’ information security 

programs as well as reviews of information security policies and the implementation 

of FISMA requirements government-wide. I hope to hear from our witnesses about 

the steps necessary to ensure that OPM meets FISMA requirements, as well as how 

other agencies are doing in this space. 

More information security systems—both in the public and private sector—will 

surely be subject to cyber-attacks in the future. And while it is impossible to completely protect a connected information security system, we must do all we can to 

protect the personal information of millions of Americans and conduct the oversight 

to ensure such steps are taken. This hearing is the beginning of a conversation on 

how we can do that and we must make sure that we follow through with action. 

I look forward to our discussion this afternoon. Thank you and I yield back the 

balance of my time. 

Chairwoman COMSTOCK. Thank you, Mr. Lipinski. 

And I now recognize the Chair of the Oversight Subcommittee, 

the gentleman from Georgia, Mr. Loudermilk, for his opening statement. 

Mr. LOUDERMILK. Thank you, Chairwoman Comstock, for holding 

this very important hearing on an issue that hits close to home for 

you, as many—as others in this country. 

I’d like to thank our witnesses for being here today in order to 

help us understand what seems to be an epidemic of cyber attacks. 

I look forward to discussing what needs need to be done to prevent 

similar attacks from occurring in the future. 

Now, it isn’t a priority, nor it should be a priority for us just to 

address this because it affects some of us that are up here, but it’s 

because it affects the American people. And unfortunately, this Administration has failed to provide Americans with any level of confidence that it will adequately protect their personal information 

when trusted with it. 

As we have witnessed over the past few months, there has been 

a concerning pattern of security breaches involving government 

computer systems. This includes the recent, massive data breach of 

the Office of Personnel Management disclosing personal and official 

information that could potentially harm our national security. For 

an Administration that touts that it has ‘‘prioritized the cybersecurity of federal departments and agencies,’’ we have instead witnessed a government that is unable to properly secure its computer 

systems and protect sensitive information. 

The situation at OPM is exactly why the subcommittee that I 

chair is looking into the collection of America’s—Americans’ personal data through the HealthCare.gov website. In that situation, 

it appears that Social Security numbers, dates of birth, names, 

mailing addresses, phone numbers, financial accounts information, 

military status, employment status, passport numbers, and taxpayer IDs are being retained. This information is being stored in 

a data warehouse that is intended to provide reporting and performance metrics related to the Federally Facilitated Marketplace 

and other HealthCare.gov-related systems. 

In the situation of the data warehouse, the Administration never 

appeared to be forthright about the use and storage of personally 

identifiable information on HealthCare.gov. The Administration 

has yet to explain the reason for indefinitely storing user information, particularly of the users of the website who input their data 

to log in but do not end up enrolling. 
13 

While this Administration has claimed that cybersecurity is a 

priority, their actions on this and other issues regarding protecting 

the American people suggests the priorities are only lip service. 

From ending the Secure Cities program to storing critical information on American citizens without their approval or knowledge, this 

Administration is proving through their actions that protecting the 

American people is far from being on their list of priorities. 

If that data warehouse is being protected in the same way that 

OPM was protecting personal information, action needs to be taken 

now to avoid putting the American people at significant personal 

risk. With many Americans being forced into the government 

healthcare exchange, a breach of this system could end up having 

millions affected, just like the OPM data hack. 

The Government Accountability Office has included the cybersecurity of federal information systems on its list of high risk areas 

since 1997, so this isn’t something new. Why, then, are we sitting 

here almost 20 years later, wondering why our federal information 

systems are not being adequately secured? 

In the most recent GAO High Risk Series report, it says that ‘‘Inspectors General at 22 of the 24 agencies cited information security 

as a major management challenge for their agency. For fiscal year 

2014, most of the agencies had information security weaknesses in 

the majority of five key control categories.’’ As Chairman of this 

subcommittee—this Committee’s Oversight Subcommittee, I want 

to find the truth behind this reckless behavior that is threatening 

the safety and security of the American people. These actions—or 

rather, lack of actions—put the future of our nation at great risk 

and must stop. 

I look forward to today’s hearing, which I anticipate will inform 

us more about the recent OPM breach and the current state of our 

federal information systems. We owe it to the American people to 

ensure that their personally identifiable information is safe and 

protected from cybercriminals. 

And with that, Madam Chair, I yield back. 

[The prepared statement of Mr. Loudermilk follows:] 

PREPARED STATEMENT OF OVERSIGHT SUBCOMMITTEE

CHAIRMAN BARRY LOUDERMILK

Thank you, Chairwoman Comstock, for holding this very important hearing on an 

issue that hits too close to home for you as well as many others in this country. 

I would like to thank our witnesses for being here today in order to help us understand what seems to be an epidemic of cyber-attacks. I look forward to discussing 

what needs to be done to prevent similar attacks from occurring in the future. 

Unfortunately, this Administration has failed to provide Americans with any level 

of confidence that it will adequately protect their personal information when entrusted with it. As we have witnessed over the past few months, there has been a 

concerning pattern of security breaches involving government computer systems. 

This includes the recent, massive data breach of the Office of Personnel Management (OPM)—disclosing personal and official information that could potentially 

harm our national security. For an Administration that touts that it has ‘‘prioritized 

the cybersecurity of federal departments and agencies,’’ we have instead witnessed 

a government that is unable to properly secure its computer systems and protect 

sensitive information. 

The situation at OPM is exactly why the Subcommittee that I Chair is looking 

into the collection of Americans’ personal data through the HealthCare.gov website. 

In that situation, it appears that social security numbers, dates of birth, names, 

mailing addresses, phone numbers, financial accounts information, military status, 
14 

employment status, passport numbers, and taxpayer IDs are being retained. This 

information is being stored in a ‘‘data warehouse that is intended to provide reporting and performance metrics related to the Federally Facilitated Marketplace (FFM) 

and other Healthcare.gov- related systems.’’ 

In the situation of the data warehouse, the Administration never appeared to be 

forthright about the use and storage of personally identifiable information on 

HealthCare.gov. The Administration has yet to explain the reason for indefinitely 

storing user information, particularly of the users of the website who input their 

data to log in, but do not end up enrolling. 

If that data warehouse is being protected in the same way that OPM was protecting personal information, action needs to be taken now to avoid putting the 

American people at significant personal risk. With many Americans being forced 

into the government health care exchange, a breach of this system could end up 

having millions affected, just like the OPM data hack. 

The Government Accountability Office (GAO) has included the cybersecurity of 

federal information systems on its list of high risk areas since 1997, so this isn’t 

something new. Why, then, are we sitting here almost twenty years later, wondering 

why our federal information systems are not being adequately secured? In the most 

recent GAO High Risk Series report, it says that ‘‘ . . . inspectors general at 22 of 

the 24 agencies cited information security as a major management challenge for 

their agency. For fiscal year 2014, most of the agencies had information security 

weaknesses in the majority of five key control categories.’’ 

As the Chairman of this Committee’s Oversight Subcommittee, I want to find the 

truth behind this reckless behavior that is threatening the safety and security of 

the American people. These actions—or rather, lack of actions—put the future of our 

nation at great risk, and must stop. 

I look forward to today’s hearing, which I anticipate will inform us more about 

the recent OPM breach and the current state of our federal information systems. 

We owe it to the American people to ensure that their personally identifiable information is safe and protected from cybercriminals. 

Chairwoman COMSTOCK. Thank you, Chairman Loudermilk. 

And I now recognize the Ranking Member of the Subcommittee 

on Oversight, the gentleman from Virginia, my colleague Mr. 

Beyer, for his opening statement. 

Mr. BEYER. Thank you, Madam Chair. And thank you, Chairs 

Comstock and Loudermilk, for holding this hearing today, incredibly timely and—because, you know, earlier today obviously New 

York Stock Exchange, United Airlines, the Wall Street Journal all 

suffering from computer glitches that has disrupted their computer 

networks. And whether this turns out to be intentional or whether—or not, it certainly highlights the potential vulnerabilities of 

our digital dependence. And today’s hearing obviously is about Office of Personnel Management. 

Deterring, detecting, and defending against the multitude of online threats that constantly lurk in the cyberspace domain is a critical issue for federal agencies and the federal government and the 

private sector alike. Last year alone, federal agencies reported 

nearly 70,000 individual computer security incidents to the U.S. 

Computer Emergency Readiness Team, or CERT. During the same 

time period, October 1, 2013, to September 30, 2014, nonfederal entities reported more than 570,000 incidents and many other incidents are potentially not identified or even not reported at all. 

Cyber threats are constant, they’re evolving, they’re very sophisticated, and many pose serious distress to companies, agencies, and 

individuals. 

The two recent data breaches at OPM are particularly important 

to me and to my constituents. Representing a Congressional District just outside the Nation’s capital, many of my constituents are 

federal employees who may have had their personal data compromised as a result of these intrusions. One of those attacks is be-
15 

lieved to have compromised the personal information of more than 

four million people and the other, up to 14 million people. And I’m 

particularly troubled that the data that was reportedly accessed included not just the personnel files but the security files of our defense, homeland security, and intelligence community employees. 

This could potentially jeopardize the financial security, personal 

safety, and ultimately the secrets that are entrusted to help protect 

the Nation. 

While the facts of this case are still being unraveled, including 

the motive for the attack, the identity of the perpetrators and the 

potential damage they may have caused, we should understand, 

too, that the federal government is not alone in being the victim 

of cyber attacks. In the past year hundreds of millions of personal 

records have been compromised by hackers targeting J.P. Morgan 

Chase, eBay, Home Depot, Target, and other private companies. I 

seem to receive a new credit card or debit card about every 6 weeks 

from my bank with a note telling me that the card has been compromised yet again. 

When I was in Switzerland, a State Department computer was 

hacked in one year, the Defense Department the next. The newspapers blamed China and Russia. Still, the OPM was significant 

and I’m particularly impacted—concerned about the impact this 

has on the morale of a federal workforce that recently has endured, 

through no fault of their own, a government shutdown, forced furloughs, staffing cuts, pay freezes. These government employees now 

have the added insult of a breach of their personal data. 

Agency heads should also be mindful and accommodating of the 

impact of federal employees who need time off to mitigate the fallout from this hack. And I encourage OPM to communicate with all 

agencies to ensure that workers are accommodated so they can 

visit their banks, Social Security offices, creditors in order to deal 

with the repercussions of the breach. 

I know every time I get a new card, I get four or five people that 

don’t get paid because the card numbers change and then they call 

and—I know it upsets my wife terribly. 

I’m also concerned that the reports of this attack suggest it may 

have been the result of individuals with ties to foreign entities and 

that particularly a private company working for the government as 

a security contractor may have been the weak link in the chain of 

events that led to the successful attack. 

We’re making steady, slow progress in fortifying our cyber defenses from potential attack. According to OMB’s annual report on 

FISMA sent to Congress in February, there’s been monitoring—improvement in federal agencies implementing continuous monitoring 

of their networks and the authentication of their users, for instance, but these results are not good enough. I know everyone on 

the panel here is interested in learning what we can do to 

strengthen the system as quickly as possible, as strongly as possible, recognizing that we’re never going to have 100 percent security, that the creative hackers, ever younger, will figure out additional ways around it. How can we create the very best advice on 

closing cybersecurity holes if and when they exist and then augmenting our security defenses against them? 
16 

So I very much look forward to your testimony and your advice, 

and Madam Chair, I yield back. 

[The prepared statement of Mr. Beyer follows:] 

PREPARED STATEMENT OF SUBCOMMITTEE ON OVERSIGHT

MINORITY RANKING MEMBER DONALD S. BEYER, JR. 

Thank you Chairs Comstock and Loudermilk for holding this hearing today. I believe this is an important hearing and I look forward to hearing from our witnesses. 

I believe this is an important and timely hearing. Earlier today it was reported that 

the New York Stock Exchange, United Airlines and Wall Street Journal are all suffering from a ‘‘computer glitch’’ that has disrupted their computer networks. Whether this event is determined to be intentional or not it highlights the potential vulnerability of our digital dependence. Today’s hearing, however, is about another 

computer incident at the Office of Personnel Management or OPM. 

Deterring, detecting and defending against the multitude of on-line threats that 

constantly lurk in the cyberspace domain is a critical issue for the federal government and private sector alike.Last year alone federal agencies reported nearly 

70,000 individual computer security incidents to the U.S. Computer Emergency 

Readiness Team or CERT. During the same time period, from October 1, 2013 to 

September 30, 2014, non-Federal entities reported more than 570,000 incidents and 

many other incidents are potentially not identified and others not reported at all. 

Cyber threats are constant and evolving, some are very sophisticated and many 

pose serious distress to companies, agencies and individuals. The two recent data 

breaches of the Office of Personnel Management (OPM) are particularly important 

to me and my constituents.Representing a congressional district just outside the nation’s Capital many of my constituents are federal employees who may have had 

their personal data compromised as a result of these intrusions. One of those attacks is believed to have compromised the personal information of more than 4 million individuals and the other is suspected to have compromised the data of as many 

as 14 million people. I am particularly troubled that the data that was reportedly 

accessed included not just the personnel files but the security files of our defense, 

homeland security and intelligence community employees. This could potentially 

jeopardize their financial security, personal safety and ultimately the secrets they 

are entrusted to help protect for our Nation. 

While the facts of this case are still being unraveled, including the motive for the 

attack, the identities of the perpetrators and the potential damage they may have 

caused, we should understand too that the federal government is not alone in being 

victim to cyberattacks. In the past year, hundreds of millions of personal records 

have been compromised by hackers targeting JP Morgan Chase, Ebay, Home Depot 

and other private companies. 

Still, the OPM breach was significant. I am concerned for the personal and professional impact of this breach on our dedicated federal workforce, particularly those 

involved in the national security arena. It should not be understated the impact this 

has on the morale of a workforce that has recently endured—through no fault of 

their own—a government shutdown, forced furloughs, staffing cuts, and pay freezes. 

These government employees now have the added insult of a breach of their personal data. 

Agency heads should also be mindful and accommodating of impacted federal employees who need time off to mitigate the fallout from the hack. I encourage OPM 

to communicate with all agencies to ensure workers are accommodated so that they 

can visit their banks, Social Security offices, and creditors in order to deal with the 

repercussions of the breach. 

I am also concerned that reports of this attack suggest it may have been the result of individuals with ties to foreign entities and I am concerned that it appears 

a private company working for the government as a security contractor may have 

been the weak link in the chain of events that ultimately led to a successful attack. 

The federal government is making steady, but slow progress in fortifying our 

cyber defenses from potential attack. According to the Office of Management and 

Budget’s (OMB’s) annual report on the Federal Information Security Management 

Act (FISMA) sent to Congress in February there has been improvement in federal 

agencies implementing continuous monitoring of their networks and the authentication of their users, for instance. But the results are still not good enough. Federal 

Agencies need to do a better job meeting the IT security criteria demanded by compliance with FISMA and they need to apply the cyber security standards recommended by the National Institute of Standards and Technology (NIST) to their 
17 

networks. At the same time, Congress and the public need to realize that no matter 

how well protected an Agency or private entity is that they will never be 100-percent secure and that data breaches are bound to occur in the future. 

I hope our witnesses can help provide us with advice on closing cyber-security 

holes when and where they exist and augmenting our security defenses against 

them. 

With that I yield back. 

Chairwoman COMSTOCK. Thank you, Mr. Beyer. And thank you 

for your leadership on this, too, and being upfront on it. 

I now recognize the Chairman of the full committee, Mr. Smith. 

Chairman SMITH. Thank you, Madam Chair. 

Today’s hearing highlights the latest and, so far, the most extensive cybersecurity failure by a federal agency, the theft of millions 

of federal employee records from the Office of Personnel Management. 

National defense in our digital age no longer just means protecting ourselves against enemies who attack with traditional 

weapons. It now means protecting America from those who launch 

cyber attacks against our computers and networks, invading our 

privacy and probably endangering lives. 

But it is about much more than solely the invasion of privacy or 

the burden to our economy. This is a national security concern, as 

these breaches expose information about members of our military 

and employees of national security agencies. 

A number of federal agencies guard America’s cybersecurity interests. Several are under the jurisdiction of the Science Committee. These include the National Science Foundation, the National Institute of Standards and Technology, the Department of 

Homeland Security’s Science and Technology Directorate, and the 

Department of Energy. All of these agencies support critical research and development to promote cybersecurity and set federal 

standards. However, it is clear that too many federal agencies like 

OPM fail to meet the basic standards of information security, and 

no one is being held accountable. 

Last year audits revealed that 19 of 24 major federal agencies 

failed to meet the basic cybersecurity standards mandated by law. 

And yet the Administration has allowed deficient systems to stay 

online. What are the consequences when a federal agency fails to 

meet its basic duties to protect sensitive information? So far it 

seems the only people penalized are the millions of innocent Americans who have had their personal information exposed. It will be 

some time before we know the full extent of the damage to personal 

and national security caused by the OPM breach of security. But 

we do know that it is critical that we prevent further attacks on 

America’s cyber systems. 

The federal government failed in its responsibility to keep sensitive and personal information secure, and Americans deserve better. The Science Committee will continue its efforts to support the 

research and development essential to strengthen our Nation’s 

cyber defenses. We will also continue to demand better answers 

from OPM on the extent of this breach. 

The Director of the Office of Personnel Management recently testified: ‘‘I don’t believe anyone (at OPM) is personally responsible.’’ 

That is not believable. In fact, it’s an insult to the American people 

who pay her salary. The government should be accountable to the 
18 

people, and this committee will continue to demand answers about 

who is responsible for failing to keep Americans’ sensitive information secure. I hope we can use lessons learned from the OPM 

breach to help find solutions to prevent the next attack. 

I look forward to hearing from our witnesses today and I’ll yield 

back. 

[The prepared statement of Chairman Smith follows:] 

PREPARED STATEMENT OF COMMITTEE CHAIRMAN LAMAR S. SMITH

Thank you Madam Chair. Today’s hearing highlights the latest and so far the 

most extensive cybersecurity failure by a federal agency - the theft of millions of 

federal employee records from the Office of Personnel Management (OPM). 

National defense in the digital age no longer just means protecting ourselves 

against enemies who attack with traditional weapons. It now means protecting 

America from those who launch cyber-attacks against our computers and networks, 

invading our privacy and probably endangering lives. 

But it is about much more than solely the invasion of privacy or the burden to 

our economy. This is a national security concern as these breaches expose information about members of our military and employees of national security agencies. 

A number of federal agencies guard America’s cybersecurity interests. Several are 

under the jurisdiction of the Science Committee. These include the National Science 

Foundation, the National Institute of Standards and Technology, the Department of 

Homeland Security’s Science and Technology Directorate, and the Department of 

Energy. 

All of these agencies support critical research and development to promote cybersecurity and set federal standards. However it is clear that too many federal agencies like OPM fail to meet the basic standards of information security—and no one 

is being held accountable. 

Last year audits revealed that 19 of 24 major federal agencies failed to meet the 

basic cybersecurity standards mandated by law. And yet the Administration has allowed deficient systems to stay online. 

What are the consequences when a federal agency fails to meet its basic duties 

to protect sensitive information? So far it seems the only people penalized are the 

millions of innocent Americans who have had their personal information exposed. 

It will be some time before we know the full extent of the damage to personal 

and national security caused by the OPM breach of security. But we do know that 

it is critical that we prevent further attacks on America’s cyber systems. 

The federal government failed in its responsibility to keep sensitive and personal 

information secure, and Americans deserve better. 

The Science Committee will continue its efforts to support the research and development essential to strengthen our Nation’s cyber defenses. We will also continue 

to demand better answers from OPM on the extent of this breach. 

The Director of the Office of Personnel Management recently testified: ‘‘I don’t believe anyone (at OPM) is personally responsible.’’ That is not believable. In fact, it’s 

an insult the American people who pay her salary. 

The government should be accountable to the people, and this Committee will continue to demand answers about who is responsible for failing to keep Americans’ 

sensitive information secure. 

I hope we can use lessons learned from the OPM breach to help find solutions 

to prevent the next attack. I look forward to hearing from our witnesses today and 

yield back. 

Chairwoman COMSTOCK. Thank you, Mr. Chairman. 

And if there are Members who wish to submit additional opening 

statements, your statements will be added to the record at this 

point. 

Now at this time I would like to introduce our witnesses. Michael 

Esser is the Assistant Inspector General for Audits at the Office of 

Personnel Management. In this role, Mr. Esser is responsible for 

overseeing audits of OPM’s information systems. Prior to joining 

the office in 1991 he worked in northern Virginia as a CPA. Mr. 

Esser holds a bachelor of science degree in accounting and a mas-
19 

ter’s degree in business administration from George Mason University. 

Our second witness today is David Snell, Director of the Federal 

Benefits Service Department for the National active and Retired 

Federal Employees Association, which represents some 300,000 active and retired federal employees and their spouses. Before joining 

there, Mr. Snell worked for nearly three decades at OPM ending 

his career there as Chief of Retirement Benefits Branch. He holds 

a bachelor of science degree from George Mason University. We 

have a theme here. Great university. 

Our third witness today is Dr. Charles Romine, Director of the 

Information Technology Laboratory at the National Institute of 

Standards and Technology. This program develops and disseminates standards for security and reliability of information systems, 

including cybersecurity standards and guidelines for federal agencies like OPM. Dr. Romine has previously served as a Senior Policy 

Analyst at the White House Office of Science and Technology Policy 

and as a Program Manager at the Department of Energy’s Advanced Scientific Computing Research Office. Dr. Romine received 

his bachelor’s degree in mathematics and his Ph.D. in applied 

mathematics from the University of Virginia. 

Today’s final witness is Dr. Gregory—let me get this right— 

Wilshusen. Okay. Mr. Wilshusen is the Director of Information Security Issues at the U.S. Government Accountability Office. Prior 

to joining GAO in 1997, Mr. Wilshusen was a Senior Systems Analyst at the Department of Education. He received his bachelor’s degree in business administration from the University of Missouri— 

I guess the non-Virginia university here—and his master of science 

in information management from George Washington University, 

close enough. 

In order to allow time for discussion, please limit your testimony 

to five minutes. Your entire written statement will be made part 

of the record. 

I now recognize Mr. Esser for five minutes to present his testimony. 

TESTIMONY OF MR. MICHAEL R. ESSER, 

ASSISTANT INSPECTOR GENERAL FOR AUDITS, 

OFFICE OF PERSONNEL MANAGEMENT 

Mr. ESSER. Chairwoman, Chairman, Ranking Members, and 

Members of the Committee, good afternoon. My name is Michael 

Esser and I am the Assistant Inspector General for audits at the 

U.S. Office of Personnel Management. Thank you for inviting me 

to testify at today’s hearing on the IT security work done by my 

office at OPM. 

OPM has a long history of systemic failures to properly manage 

its IT infrastructure, which may have ultimately led to the recent 

data breaches. We are pleased to see that the agency is taking 

steps to improve its IT security posture but many challenges still 

lay ahead. 

To begin, I would like to discuss some of the findings from our 

annual audits under the Federal Information Security Management 

Act, known as FISMA. We have identified three general areas of 

concern which are discussed in detail in my written testimony. 
20 

The first area is information security governance. This is the 

management structure and processes that form the foundation of 

a successful security program. It is vital to have a centralized governance structure. OPM has made improvements in this area but 

it is still working to recover from years of decentralization. 

The second area is security assessments and authorizations. This 

is a comprehensive assessment of each IT system to ensure that it 

meets the applicable security standards before allowing the system 

to operate. Our 2014 FISMA audit found that 11 of OPM’s 47 

major systems were operating without a valid authorization. Because of actions taken by the CIO in April 2015 we expect this 

number to more than double by the end of fiscal year 2016. 

The third area is technical security controls. OPM has implemented a variety of controls to make the agency’s IT systems more 

secure. However, these tools must be used properly and must cover 

the entire IT environment. Our FISMA audit last year found that 

they were not. 

These areas represent fundamental weaknesses in OPM’s IT security program that have been reported to the OPM Director, 

OMB, and the Congress for many years. The fact that these longstanding issues were allowed to continue for so long without being 

taken seriously raises questions about the inherent effectiveness of 

the original FISMA legislation and implementing guidelines. 

Since 2002 the IGs have been reviewing their agencies’ information security programs, but the reporting guidelines from OMB 

were focused on compliance with specific security areas and lacked 

perspective on the overall effectiveness of the agency’s program. 

The FISMA Modernization Act of 2014 shifts the focus from review and compliance to assessing effectiveness of security controls. 

In addition, a new maturity model approach to evaluating the state 

of agencies’ continuous monitoring programs was introduced in this 

year’s FISMA reporting instructions for OIGs. These new developments should go a long way toward improving the IT security programs of federal agencies. OMB and DHS should also work toward 

making the OIG FISMA reporting metrics more reflective of the 

current risks and threats and further adopting the maturity model 

approach for other reporting domains. 

I would also like to take a moment to discuss e-QIP, the IT system that OPM uses to collect information related to federal background investigations. Just last week, OPM disabled the system 

due to serious vulnerabilities detected in the design of the database 

and public facing website. While we agree with the actions taken, 

OPM has known about vulnerabilities in the system for years but 

has not corrected them. During the 2012 security assessment and 

authorization process for e-QIP, an independent assessor identified 

18 security vulnerabilities which still remain open and 

unaddressed today. We believe this is an example of the importance of the security assessment process and also of OPM’s historical negligence of IT security in general. 

Moving forward, OPM is undertaking a massive infrastructure 

improvement project which, when completed, should significantly 

improve the agency’s IT security posture. However, we identified 

several concerns related to OPM’s failure to follow proper project 
21 

management processes and the agency’s use of a sole-source contract. These are discussed in more detail in my written testimony. 

We fully support OPM’s modernization efforts but we are concerned that if this project is not done correctly, the agency will be 

in a worse situation than it is today and millions of taxpayer dollars will have been wasted. 

Thank you for your time and I’m happy to answer any questions. 

[The prepared statement of Mr. Esser follows:] 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 

Chairwoman COMSTOCK. Thank you. 

And I now recognize Mr. Snell for five minutes to present his testimony. 

TESTIMONY OF MR. DAVID SNELL, DIRECTOR, 

FEDERAL BENEFITS SERVICE DEPARTMENT, 

NATIONAL ACTIVE AND RETIRED FEDERAL 

EMPLOYEES ASSOCIATION 

Mr. SNELL. Thank you. Good afternoon and thank you for inviting me to testify. I appreciate the opportunity to express NARFE’s 

views regarding the recent data breaches at the Office of Personnel 

Management, OPM. We are deeply concerned over the failure of 

the federal government to protect its personnel computer systems 

and the devastating impact the recent breaches of these systems 

may have on national security, as well as on the financial and personal security of millions of current and former federal employees. 

Let me be clear. The potential consequences of these breaches 

are severe. The personal records obtained through the data 

breaches include the highly personal and sensitive information of 

millions of current and former employees and even applicants for 

federal employment. The extent of the breaches is enormous, likely 

reaching beyond 18 million individuals. 

Possession of the information contained in the Standard Form 

86, a 120-page security clearance form containing an applicant’s 

life history, could give our enemies the means to attempt to corrupt 

or blackmail government employees and compromise military and 

intelligence secrets. Moreover, it could make public servants vulnerable to grave risks to their personal security and that of their 

families and loved ones. 

While the perpetrators of this act bear the obvious and primary 

fault in this matter, the federal government, including both the Administration and Congress, has an obligation to do its best to protect the sensitive information its employees and job applicants are 

required to disclose as a condition of employment. It failed to meet 

that obligation. 

Despite explicit warnings by Inspectors General since 1997, OPM 

failed to put in place adequate safeguards for both its aged and 

newer computer systems. This permitted the theft of massive 

amounts of personally identifiable information. Even now, the current OPM Inspector General issued a flash audit of OPM’s plans 

to improve its data security and found them to have ‘‘a very high 

risk of project failure.’’ 

Our government has failed its employees. It is imperative to act 

swiftly and ensure an incident of this magnitude does not repeat 

itself. The Congressional oversight and response, including this 

hearing, is a good start, but we need continued vigilant efforts to 

improve the federal government’s information technology and data 

security for the future. 

The federal government, including both the Administration and 

Congress, now has an obligation to remedy to the best of its ability 

what has transpired. This should have started with effective communication with federal employees, retirees, and others affected by 

the breaches and the organizations that represent them. Unfortunately, communications has fallen short of expectations. While 
34 

OPM has provided notice to those affected by the breach announced 

June 4 and has communicated with organizations in that regard, 

it has thus far failed in its basic duty to inform individuals affected 

by the second and more troubling breach announced June 12 and 

continues to fail to answer many important questions about both 

breaches. The failure of OPM to safeguard personal information 

should not be compounded by deflecting questions. 

Our written testimony details many of the questions we are still 

seeking answers to regarding the details of exactly what data has 

been accessed. The federal community and everyone affected by the 

data have been—data breach deserves answers to these questions. 

In addition, to better communication, the federal government 

should provide lifetime credit monitoring and additional identity 

theft insurance. The 18 months of credit monitoring offered by 

OPM is woefully inadequate. The depth of personal information exposed is enormous and the threat to individuals extends way beyond 18 months. It is only fair to provide financial protection in 

line with the threat that has been posed. Furthermore, Congress 

should appropriate funds necessary to provide this protection. 

The question posed in the title of this hearing ‘‘Is This the Tip 

of the Iceberg?’’ is a valid one. While I cannot answer that, I will 

say I certainly hope not. The recent breaches should be a wake-up 

call to this country and its leaders about the dangers of cyber terrorism and the critical need to protect our government’s core functions. Let’s make sure this isn’t the tip of the iceberg but rather 

the last time our federal government has to deal with cybersecurity 

breach that threatens the financial security of its employees. 

Thank you again for the opportunity to share our views. 

[The prepared statement of Mr. Snell follows:] 
35 
36 
37 
38 
39 
40 
41 

Chairwoman COMSTOCK. Thank you, Mr. Snell. 

And now, Dr. Romine, for five minutes for your testimony. 

TESTIMONY OF DR. CHARLES ROMINE, DIRECTOR, 

INFORMATION TECHNOLOGY LABORATORY, 

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 

Dr. ROMINE. Chairwoman Comstock, Chairman Loudermilk, 

Ranking Member Lipinski, Ranking Member Beyer, and Members 

of the Subcommittees, I’m Dr. Charles Romine, Director of the Information Technology Laboratory at NIST. Thank you for the opportunity to appear before you today to discuss our responsibilities 

for assisting federal agencies with cybersecurity. 

NIST has worked in cybersecurity with federal agencies, industry, and academia since 1972. Our role, to research, develop, and 

deploy information security standards and technology to protect information systems against threats to the confidentiality, integrity, 

and availability of information and services was strengthened 

through the Computer Security Act of 1987, broadened through the 

Federal Information Security Management Act of 2002 or FISMA, 

and reaffirmed in the Federal Information Security Modernization 

Act of 2014. 

NIST carries out its responsibilities under FISMA through the 

creation of a series of Federal Information Processing Standards, or 

FIPS, and associated guidelines. Under FISMA agencies are required to implement those FIPS. To further assist agencies, NIST 

provides management, operational, and technical security guidelines covering a broad range of cybersecurity topics. 

NIST has a series of specific responsibilities in FISMA to—of 

particular relevance to today’s hearing were addressed by NIST 

and published as FIPS 199, the standard for security categorization 

of federal information and information systems; and FIPS 200, 

which sets the minimum security requirements based on the categorization identified using FIPS 199. 

NIST created baselines for these minimum security requirements 

based on three levels determined in accordance with FIPS 199: low, 

moderate, and high. For example, at a high categorization, FIPS 

199 states that ‘‘the loss of confidentiality, integrity, or availability 

could be expected to have a severe or catastrophic adverse effect on 

organizational operations, organizational assets, or individuals.’’ 

Examples of controls included in the associated baselines then 

cover a range of requirements for a lifecycle of security. For example, security awareness and training, contingency planning, access 

control, system disposal, and incident response. Once a baseline is 

established, NIST provides guidance to agencies to assist in determining that the baseline is adequate to meet their risk-based requirements. 

An agency may need to enhance a given baseline to address local 

risks, the agency’s mission, and technical infrastructure. For example, an agency with a real-time monitoring system such as 

workstations in air traffic control or critical patient monitoring systems might not want to use a timed password-locked screensaver 

to mitigate security issues for unattended workstations. Instead, a 

guard or site surveillance system might be more appropriate to 

support the mission and still meet the intent of the baseline. 
42 

Establishing a sound security baseline is not the end of security 

for an agency. NIST provides standards, guidelines, and tools for 

agencies to test and assess their security and continuously monitor 

their implementation and new risks. The authorization of a system 

by a management official is an important quality control under 

FISMA. By authorizing a system, the manager formally assumes 

responsibility for operating a system at an acceptable level of risk 

to the agency operations or individuals. 

Under FISMA, NIST does not assess ,audit, or test agency security implementations. Congress recognized that placing such responsibilities on NIST would impede its ability to work with federal agency and private-sector stakeholders to develop standards, 

guidelines, and practices in the open, transparent, and collaborative manner that Congress intended. 

NIST’s statutory role as the developer but not the enforcer of 

standards and guidelines under FISMA have ensured NIST’s ongoing ability to engage freely and positively with federal agencies on 

the implementation challenges and issues they experience in using 

these standards and guidelines. NIST is committed to continue to 

help agency officials address their responsibilities under FISMA to 

understand and mitigate risks to their information and information 

systems that could adversely affect their missions. 

We recognize that we have an essential responsibility in cybersecurity and in helping industry, consumers, and government to 

counter cybersecurity threats. Active collaboration within the public sector and between the public and private sectors is the only 

way to effectively meet this challenge leveraging each participant’s 

roles, responsibilities, and capabilities. 

Thank you for the opportunity to testify today on NIST’s work 

in federal cybersecurity and I would be happy to answer any questions that you may have. 

[The prepared statement of Dr. Romine follows:] 
43 
44 
45 
46 
47 
48 
49 
50 

Chairwoman COMSTOCK. Thank you, Doctor. 

And I now recognize Mr. Wilshusen for five minutes to present 

his testimony. 

TESTIMONY OF MR. GREGORY WILSHUSEN, DIRECTOR, 

INFORMATION SECURITY ISSUES, 

U.S. GOVERNMENT ACCOUNTABILITY OFFICE 

Dr. WILSHUSEN. Chairman Comstock, Chairman Loudermilk, 

Ranking Members Lipinski and Beyer, and Members of the Subcommittees, thank you for the opportunity to testify at today’s 

hearing. 

The recent OPM data breaches affected millions of federal employees. However, OPM is by no means the only agency to suffer 

data breaches or face challenges securing its computer systems and 

information. The number of information security incidents both 

cyber and non-cyber reported by federal agencies continues to rise, 

increasing from about 5,500 in fiscal year 2006 to over 67,000 in 

fiscal year 2014. Similarly, the number of incidents involving personally identifiable information more than doubled in recent years 

to over 27,000 in fiscal year 2014. These incidents illustrate the 

need for stronger information security controls across the federal 

government. 

Today, I will discuss several cyber threats to federal systems, cybersecurity challenges facing federal agencies, and governmentwide 

initiatives aimed at improving cybersecurity. 

Before I begin, if I may, I’d like to recognize members of my team 

who are instrumental in developing my statement and some of the 

work underpinning it. With me today is Larry Crosland, an Assistant Director who led this body of work. I also want to recognize 

Brad Becker, Lee McCracken, Chris Businsky, Scott Pettis, who 

also made significant contributions. 

Madam Chairwoman, Mr. Chairman, the federal government 

faces an array of cyber-based threats to its computer networks and 

systems. These threats include both targeted and untargeted attacks from a variety of sources, including criminal groups, hackers, 

disgruntled insiders, and foreign nations. These sources vary in 

terms of their capabilities, willingness to act, and motives, which 

can include seeking monetary gain or pursuing an economic, political, or economic advantage. 

In the grip of these threats, most federal agencies face challenges 

securing their systems and networks. Agencies continue to have 

shortcomings in assessing risks, developing and implementing security controls, and monitoring results. For example, 19 of 24 agencies covered by the Chief Financial Officers Act reported that information security weaknesses were either significant deficiency or 

material weakness for financial reporting purposes. And the Inspectors General at 23 of these agencies cited information security 

as a major management challenge for their agency. 

Agencies also need to provide better oversight of the security 

their contractor operator systems. Five of six agencies we reviewed 

did not consistently assess their contractors’ information security 

practices and controls, resulting in security lapses. 

Even with effective controls, security incidents and data breaches 

can still occur. Agencies need to react swiftly and appropriately 
51 

when they do. However, seven agencies we reviewed had not consistently implemented key operational practices for responding to 

data breaches involving personal information. GAO and agency IGs 

have made hundreds of recommendations to assist agencies in addressing these and other challenges. Implementing these recommendations will help strengthen agencies’ ability to protect their 

systems and information. 

DHS and the Office of Management and Budget have also 

launched several governmentwide initiatives to enhance cybersecurity. One such initiative is requiring stronger authentication of 

users through the use of personal identity verification, or PIV 

cards. However, OMB recently reported that only 41 percent of 

agency user accounts at 23 civilian agencies required PIV cards for 

accessing agency system’s. 

Another initiative, the National Cybersecurity Protection System 

is intended to detect and prevent malicious network traffic from entering federal civilian networks. GAO is presently reviewing the 

implementation of this system. Our preliminary observations indicate that the systems intrusion detection and prevention capabilities may be useful but are also limited. 

While governmentwide initiatives hold promise for bolstering the 

federal cybersecurity posture, no single technology or set of practices is sufficient to protect against all cyber threats. A multilayered defense in-depth strategy that includes well-trained personnel, effective and consistently applied processes, and appropriate technologies is needed to better manage cyber risks. 

This concludes my oral statement. I’d be happy to answer your 

questions. 

[The prepared statement of Mr. Wilshusen follows:] 
52 
53 
54 
55 
56 
57 
58 
59 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
70 
71 
72 
73 
74 
75 
76 
77 
78 

Chairwoman COMSTOCK. I thank the witnesses for their testimony and for your expertise and work on this over quite a long 

time. 

I would like to remind Members that the Committee rules limit 

our questioning to five minutes and I now recognize myself for five 

minutes of questions. 

A Washington Post editorial from this past Sunday, July 5, they 

said the OPM Director knew as well as anyone how sensitive the 

data was, yet the door to her agency was apparently left ajar. 

Thieves walked out with an intelligence goldmine. This was an unforgivable failure of stewardship that should lead to firings for incompetence. 

Mr. Esser, to your knowledge has OPM reprimanded or fired any 

official over this failure to protect its employees’ most sensitive 

data? 

Mr. ESSER. I’m not aware of any. 

Chairwoman COMSTOCK. Are you aware of any discussions to 

that effect? 

Mr. ESSER. No, I haven’t heard any. 

Chairwoman COMSTOCK. Okay. Thank you. 

And, Mr. Snell, really thank you for being here and representing 

so many people not just here in our metropolitan area but all 

across the country because this impacts our contractors, our federal 

employees, so it’s important for people to understand that this is 

really a nationwide breach and, you know, you’re representing people who are aware of this but there’s still many more that aren’t. 

Could you tell us what some of their concerns and unanswered 

questions are and how you think additional things that might be 

helpful for the employees and from what you’ve heard that we 

might ask for to help answer the questions that you’ve been getting 

from people? 

Mr. SNELL. Thank you. I’d be glad to. A lot of the folks we hear 

from are members as well as others. Their main concern is trust 

and trust in what they get. The information came to many of them 

through email. The email address was not a government email address. It was a .com address. They didn’t know whether to open it, 

they didn’t know what to do with it. They had little information. 

Many people have received letters. Those people don’t have internet. They didn’t—they weren’t able to access the frequently asked 

questions and the explanations that the Office of Personnel Management had available out there. And so they were left in the dark. 

They didn’t know if they called the number, if they contacted 

anybody if they could ever trust them, so we have a lot of distrust 

out there. A lot of folks are scared obviously. They don’t know 

what’s going happen. Some folks who have not been notified that 

their records were compromised are wondering, you know, were my 

records compromised? Can I trust the fact that I didn’t get notice 

or is this another, you know, problem? So those are the questions, 

those are the concerns that we hear from our members both current federal employees and retirees. 

Chairwoman COMSTOCK. Thank you. I appreciate that and we 

look forward to continuing to work with you on identifying any of 

those and how we can help answer their questions. 
79 

I was wondering, maybe a question for all of you, what kind of 

things, if someone has had their information breached or compromised, what should they be on the lookout for now? What would 

be an unusual type of situation that should raise the antenna and 

say this might be something I need to pay attention to? Can you 

think of some scenarios just so that people can get an idea of what 

they have to be on the lookout for? 

Dr. WILSHUSEN. Sure. I’ll start it off. First of all, individuals who 

believe their information may have been compromised or been notified that it has been should certainly check their credit reports to 

see if there have been any new credit accounts or charges that 

they’re unaware of that may have cropped up, and certainly that’s 

probably one of the basic things that individuals should do. They 

should also know that they are entitled to receive a free credit report from each of the three credit reporting agencies on an annual 

basis and that’s something that one should do on a regular basis 

annually is to check each—credit reports from each of those organizations. 

Indeed, if they do receive the letter, as I have, is to also check 

to see about subscribing to the service that OPM is offering 

through their contractor because they, too, will provide—or supposed to provide anyway—some surveillance on the part of the individual. 

Chairwoman COMSTOCK. Okay. 

Mr. SNELL. I would add to that—and those are excellent suggestions. I would add to that that any statement they get regarding 

any other benefits they get from any other company or government 

entity such as Social Security, if there’s something that has 

changed without their knowledge, they should report that right 

away. We had one member who found out his address on his Social 

Security payments had changed without his authorization. Being 

this close to the events of the breaches, of course, that member was 

concerned that this had been connected. But we did report it to 

OPM. The OPM folks had looked into it and decided that it was 

a separate incident. But still, any kind of changes like that, people 

should look into. 

Chairwoman COMSTOCK. Okay. And one other thing I was wondering, should—a lot of people don’t know what’s necessarily in 

their personnel file. Have people asked you about possibly having 

copies of their personnel file, having copies of their background 

check? Because, you know, if something starts coming up, you don’t 

necessarily know what’s in your background check, right, or even 

your personnel file even though you fill it out. Particularly with the 

background checks, those people aren’t going to have any idea what 

people have said, right? 

Mr. SNELL. Right. We haven’t heard from anybody—any of our 

members with that particular request so— 

Chairwoman COMSTOCK. Okay. Thank you. And I now turn over 

to questions from Mr. Lipinski. 

Mr. LIPINSKI. Thank you. I want to get down to the big question 

and what—in terms of what we should do moving forward here. It’s 

not acceptable for these data breaches to occur at OPM, anywhere 

else in the government, or in the private sector. We know—okay, 

we accept—we know that they can happen but I sometimes feel 
80 

like there’s not enough done not just in the public sector but the 

private sector to prevent these. 

So my question is how do we make FISMA effective? I understand, as Dr. Romine said, that NIST, for good reason, only sets 

the standards; they’re not the enforcer. So who should be, who can 

be the enforcer when it comes to the federal government? And I 

want to—just want to try to figure this out so that we can get 

someone so we know who’s accountable, who can be held accountable, and who has the responsibility. So, Mr. Esser, what would 

you recommend? 

Mr. ESSER. Well, one possibility is OMB. I mean we—as an IG 

office we audit, we report, and we identify, you know, areas of 

weakness but that’s as far as our authority extends. We have no 

enforcement authority. Those reports go eventually to OMB and 

that could potentially be one area of enforcement. 

Mr. LIPINSKI. Dr. Romine, do you have any recommendations? 

Dr. ROMINE. No, I think that’s right. The oversight function, as 

it currently is set up under FISMA, I think is OMB with more recently DHS providing assistance to agencies to meet their obligations under FISMA. So I think that’s the right answer. 

Mr. LIPINSKI. Mr. Wilshusen, do you have anything to add? 

Dr. WILSHUSEN. Yeah, I would agree to same extent that both of 

the other witnesses mentioned, but I would also just like to point 

out that under law both under the FISMA 2002 and FISMA 2014 

it is clearly the responsibility of the head of each agency to implement the appropriate information security protections to reduce the 

risk and magnitude of harm that could occur should information or 

information systems be compromised through unauthorized access, 

use, disclosure, modification, destruction, and disruption. And so 

clearly in terms of responsibility it’s the head of agencies—each 

agency head to make that happen. 

Mr. LIPINSKI. Is there anything more that you recommend that 

we do? As you said, FISMA has been updated but is there anything 

more that should be done with, you know, that Congress should do 

with FISMA? Does anyone have any recommendations for anything 

further? 

Dr. WILSHUSEN. Well, I would just say first that I think Congress 

did—went quite a distance in terms of modernizing FISMA to include clarifying their roles and responsibilities for information security across the federal government, particularly with assigning 

responsibilities to the Department of Homeland Security, who has 

now responsibility for assisting and overseeing to an extent implementation security controls at the federal agencies. 

It also recognizes the need for new types of security controls and 

procedures to be put in place such as continuous monitoring, continuous diagnostics and mitigation, which is another type of control 

set that, if effectively implemented, could assist agencies in better 

protecting their systems, identifying their risk, and addressing the 

key vulnerabilities first. 

Mr. LIPINSKI. Okay. Mr. Esser, did you want to add something? 

Mr. ESSER. Yeah. I agree with Mr. Wilshusen, and I think from 

our viewpoint, the FISMA Modernization Act of 2014 went a long 

ways toward improving the situation, changing our reviews from 

more of a compliance check of a yes or a no, do they have—or do 
81 

they do security controls testing to an effectiveness test of how 

good are those tests and moving towards continuous monitoring 

and the mature model that is being put in place. So we think continuing to move along that path is the right direction. 

Mr. LIPINSKI. Anyone else have anything to add? 

Good. All right. Thank you very much. I yield back. 

Chairwoman COMSTOCK. Thank you. 

And I now recognize Mr. Loudermilk. 

Mr. LOUDERMILK. Thank you, Madam Chair. 

Mr. Wilshusen, as I mentioned in my opening statement, the situation we have at OPM is exactly why my subcommittee is investigating the collection of America’s personal data through 

HealthCare.gov. In September 2014, the GAO came out with a report noting that HealthCare.gov’s data warehouse system MIDAS 

did not have an approved Privacy Impact Assessment that included 

a thorough analysis of privacy risks. Given that MIDAS is processing personally identifiable information and appears to have—indefinitely storing that information, how important is it to have an 

approved privacy impact statement for—or assessment for MIDAS? 

Dr. WILSHUSEN. I think it’s vitally important because in that it 

helps the agencies to identify not only the privacy risks associated 

with that particular system but also alternatives and the controls 

that should be in place to better protect and help protect that information. 

Mr. LOUDERMILK. Thank you. 

Dr. WILSHUSEN. And we recommended—we also noted that not 

only had CMS not effectively implemented—or designed a policy 

impact assessment for MIDAS but for other systems connected 

with HealthCare.gov. 

Mr. LOUDERMILK. Do you know if an assessment is done since 

the September report? 

Dr. WILSHUSEN. We just received information from—we actually 

made a recommendation that in their Privacy Impact Assessment 

that they assess these privacy risks and today we believe that recommendation is still open—— 

Mr. LOUDERMILK. So do they—— 

Dr. WILSHUSEN. —and not fully implemented by—— 

Mr. LOUDERMILK. They have not—is that concerning? 

Dr. WILSHUSEN. Well, we believe they should do that, yes. 

Mr. LOUDERMILK. Okay. When you looked into the MIDAS system as part of the HealthCare.gov review, was it known to you that 

personally identifiable information of individuals who signed up on 

the HealthCare.gov website would be indefinitely stored? 

Dr. WILSHUSEN. It was known that initially the CMS officials indicated that personally identifiable information may not be stored 

and it—but then they acknowledged that it would be and it was because of that acknowledgement that personally identifiable information would be stored in MIDAS, that the need for assessing 

those privacy risks is important as part of a Privacy Impact Assessment. 

Mr. LOUDERMILK. Okay. So the fact that they indicated that they 

intended to store this PII information is really what catapulted this 

assessment, the need for the assessment? Is that what you’re saying? 
82 

Dr. WILSHUSEN. Right. Any new development or system should 

have a Privacy Impact Assessment if personally identifiable information is going to be collected, stored, or disseminated through 

that system. 

Mr. LOUDERMILK. Is it normal for the federal government to store 

PII information on websites or information obtained through 

websites? 

Dr. WILSHUSEN. I would say that that is normal for agencies to 

store personally identifiable information, some of which may be obtained through a website, but we—I have not looked at that specifically with regard to collection of information through websites. 

Mr. LOUDERMILK. Okay. I appreciate that. Also, GAO has listed 

the security of our federal cyber assets on its high-risk list since 

1997. It’s been almost 20 years. Does it remain on the high-risk list 

to this day because of evolving threats to federal information systems or is it because federal agencies have not been able to learn 

how to properly protect these systems? 

Dr. WILSHUSEN. I would say both—— 

Mr. LOUDERMILK. Okay. 

Dr. WILSHUSEN. —because certainly there’s an inherent risk to 

agency systems because of the evolving threats and just the complexity of the systems that agencies develop and operate because 

many—much of the software that agencies use have vulnerabilities 

in it, some discovered, some undiscovered. But at the same time it’s 

incumbent upon federal agencies to implement the appropriate security controls to mitigate those risks to—at a cost-effective and acceptable level. And we found that agencies have not consistently 

implemented agencywide information security programs to mitigate 

that risk effectively. 

Mr. LOUDERMILK. Is it because of—it’s a lack of priority for a lot 

of these agencies? 

Dr. WILSHUSEN. In some cases it might be but it’s also in other 

cases I believe it’s just to the fact that there are a number of actions that agencies just haven’t really taken that they need to take 

such as installing patches on a timely manner and assuring that 

known vulnerabilities are ameliorated in a timely manner. 

Mr. LOUDERMILK. Can you tell me who’s ultimately accountable 

for the cybersecurity of our federal government? 

Dr. WILSHUSEN. Accountable or responsible? You know, I have to 

say in terms of at least for federal agencies, the agency head is responsible for implementing effective security controls and that’s 

under law under FISMA. At the same time in terms of accountable 

that’s harder to measure because to my knowledge it’s difficult to 

see what accountability mechanisms are in place to assure that individuals are effectively securing systems. That could be done 

through personnel performance expectations, but in terms of individuals being held to account for that is somewhat uncertain. 

Mr. LOUDERMILK. I see I’m out of time. One quick question if I 

may, Madam Chair. 

Chairwoman COMSTOCK. We’re just tight because we’re going to 

have votes. 

Mr. LOUDERMILK. Okay. 

Chairwoman COMSTOCK. We want to squeeze everybody in. 
83 

Mr. LOUDERMILK. On a scale grading like elementary school A to 

F, our federal cybersecurity, how do you grade it? 

Dr. WILSHUSEN. D. 

Mr. LOUDERMILK. D minus from the way I hear that? 

Dr. WILSHUSEN. I’ll go with D because in many respects there 

are improvements within federal information security and some of 

the initiatives but it’s getting to the effective implementation of 

those security controls and the—some of the initiatives. Over time, 

consistently, that’s been proved challenging. 

Mr. LOUDERMILK. Thank you very much. Thanks to all the panel. 

Chairwoman COMSTOCK. Thank you. 

I now recognize Mr. Beyer for five minutes. 

Mr. BEYER. Thank you, Madam Chair. 

Mr. Snell, do you know how long it takes to have a negative report, a so-called derogatory report on your credit report drop off? 

Mr. SNELL. [Nonverbal response.] 

Mr. BEYER. Okay. Well, six to eight years. I only bring that up 

because it’s a long time. 

Mr. SNELL. It is a long time. 

Mr. BEYER. And I want to bring—call attention to something that 

you mentioned in your written report where you say ‘‘the federal 

government should offer identity theft insurance, should offer credit monitoring services for the lifetime of anyone affected, and increase the amount of identity theft insurance provided in certain 

circumstances. Unlimited coverage may be required.’’ I just want 

all of us to highlight that because this is I think really an initiative 

that we can bring as Democrats and as Republicans on Oversight 

to this issue. 

Mr. SNELL. Well, thank you. 

Mr. BEYER. So thank you for bringing that up because it—by the 

way, the other rhetorical question, do you know how long it takes 

them to fix something that’s wrong on a credit report, which is like 

impossible? So—— 

Mr. SNELL. It’s a nightmare. 

Mr. BEYER. Yes. 

Mr. Esser, your testimony was pretty devastating, all the things 

that didn’t get fix that were identified year in and year out within 

OPM. And I’m just baffled by it. Do you have any idea why? Is this 

a series of CIOs who didn’t respond? Is it a series of Directors, 

Democrat, Republican administrations that didn’t respond? Does 

any of it come back to us on Congress because we didn’t allocate 

the resources necessary, the hardware, the software, the staffing to 

make all this happen? For example, you mentioned in there that 

OPM has decided they needed a legacy system. With legacy systems, you couldn’t go back and tinker with them one by one; you 

had to do an overhaul. Help us understand this lack of leadership 

and lack of action on something that you guys as Inspectors General had clearly identified. 

Mr. ESSER. I would have to guess it’s a combination of factors. 

Certainly, there’s been, you know, different directors and different 

CIOs during the time period that we’ve reported material weaknesses in IT security. You know, so, you know, if you look at the 

current Director, she wasn’t there when this all started. The current CIO wasn’t there when this all started. But at the same time 
84 

there’s been current issues that we’ve reported that, you know, 

they also haven’t gotten addressed in a timely fashion that we 

would like to see them addressed. 

Resources I think is always an issue but it’s not the sole answer. 

I think sometimes we feel like things that we report don’t get the 

attention that they should get. We’ve had, you know, weaknesses 

that have been outstanding for, you know, years and years and 

years and that just shouldn’t be. 

Mr. BEYER. All right. Well, thank you. Thank you, Mr. Esser. 

Dr. Romine, did I say that right? 

Dr. ROMINE. [Nonverbal response.] 

Mr. BEYER. On NPR this morning they were talking about the 

difficulty that our military and our intelligence units are having 

with ISIS encrypting messages between their potential recruits. 

Can we use this encryption for federal government data? 

Dr. ROMINE. I don’t know what encryption they’re using but we 

do have access to strong encryption, and in fact NIST in my laboratory has been in the encryption space for decades now starting with 

the original DES, Data Encryption Standard, that was developed 

through NIST. 

We certainly recognized—our guidance provides input that 

encryption is a very powerful tool for securing information. It’s not 

the only one in the arsenal but it is a very effective one and often 

not very costly. And so I think certainly it’s an avenue for protecting the data. 

Mr. BEYER. You know, I know you’re not responsible for the private sector and it seems that you clearly have developed some very 

thoughtful guidelines and protocols for how the federal government 

should work. Do you have any sense of whether the federal government leads or lags the private sector in terms of cybersecurity, data 

encryption, all the things we’re talking about today? 

Dr. ROMINE. So I think there are bright spots in both cases. I 

mean I think there are—it’s uneven in the private sector just as 

it’s uneven in the federal government as well. I will say that the 

guidelines and the standards that we issue that are principally intended for the federal government are often picked up by the private sector because of the quality of those guidelines and standards. And in fact we depend on the private sector to participate and 

provide us with input. We have a multiphase comment period for 

almost all of our guidelines so that we get the best minds in the 

private sector and public sector to contribute. 

Mr. BEYER. Thank you. 

Madam Chair, I yield back. 

Chairwoman COMSTOCK. Thank you. 

I now recognize Mr. Johnson for five minutes. 

Mr. JOHNSON. Thank you, Madam Chairman. And, gentlemen, 

thank you for joining us today. 

I—you know, cybersecurity and the kind of attack that we saw 

on OPM I think—and I believe I read it here somewhere earlier 

today—is just the tip of the iceberg. As a 30-year IT professional 

myself, I firmly understand that as long as computers are working 

off of 1s and 0s, the bad guys are going to be out there trying to 

get in. And the battle space is huge and our ability to protect it 

is going to require constant vigilance. It’s not a problem that has— 
85 

it’s not a race that has a finish line because as soon as we get to 

one point, the goalposts are moved and the game strategy changes. 

And I spent a lot of my time helping to educate and inform those 

that will listen so that we understand. But this is a big issue and 

communications and computing technologies are foundational to 

our economy and to virtually every industry that supports our 

economy, including our own national security. So it’s a really big 

issue. 

Mr. Esser, the OPM Director has stated that some of OPM’s network systems are so old that it has been difficult if not impossible 

to upgrade and encrypt them. How credible is that explanation and 

how many of the OPM systems that were hacked were these old 

legacy systems versus more modern ones capable of encryptions 

and upgrades? 

Mr. ESSER. I don’t have an exact count of how many are legacy 

systems and how many are modern. There is a lot of credibility to 

what she says. There are old systems at OPM that it is difficult 

to bring into the modern area of security, not that it can’t be done 

but it can be difficult. But our understanding is that at least a few 

of the systems that were hacked are more modern systems that 

certainly, you know, modern encryption techniques and other security techniques could have been implemented on. 

Mr. JOHNSON. Right. Okay. Well, a complete overhaul of the existing IT infrastructure at OPM could take years, right? Do you believe that there are intermediate steps OPM could take to address 

security needs in the short-term? 

Mr. ESSER. There are and they have taken some of those steps. 

They’ve— 

Mr. JOHNSON. What are those? Can you enumerate some of 

them? 

Mr. ESSER. Well, when the initial breach took place in 2014 and 

they began working on tightening up their systems, they went into 

what they call a tactical phase of immediately remediating some of 

the high security problems they had. And so we’re fully in favor of 

everything they’ve done related that. You know, things like, you 

know, requiring more two-factor authentication. They’re not fully 

there but they’re working on it so they have taken steps to tighten 

up systems in that respect. 

Mr. JOHNSON. Okay. Dr. Romine and Mr. Wilshusen—do I have 

that right? 

Dr. WILSHUSEN. Close enough. It’s Wilshusen. 

Mr. JOHNSON. Wilshusen, okay. I apologize. Johnson is pretty 

easy for everybody so I don’t ever have that problem. Sorry. 

Dr. Romine and Mr. Wilshusen, do you agree? Are there things 

that can be done in the near term? Are there more things that can 

be done in the near term? 

Dr. ROMINE. Well, certainly from the perspective of the NIST 

guidelines and FISMA guidelines that we issue I think we put 

those out as a means of reducing the susceptibility of the system 

to hack. Nothing is 100 percent secure but I think following those 

guidelines is the most effective way that I can think of to protect 

the systems. 

Mr. JOHNSON. Mr. Wilshusen? 
86 

Dr. WILSHUSEN. And I would agree with both what Dr. Romine 

and Mr. Esser said. One thing that comes to mind, too, is based 

on what’s been reported by the Office of Management and Budget 

as it relates to OPM is that, as of the end of fiscal year 2014, OPM 

had only implemented the use of personal identity verification 

cards or strong authentication for one percent of its user accounts. 

My understanding is that they’re making progress now to improve 

that but certainly having strong authentication, using multifactor 

authentication for user accounts would be one area that it seems 

that OPM could improve on and may be working on that now. 

Mr. JOHNSON. Okay. Well, gentlemen, thank you very much and 

I’ve exhausted my time. 

Madam Chair, I yield back. 

Chairwoman COMSTOCK. Thank you. 

I now recognize Ms. Bonamici. 

Ms. BONAMICI. Thank you very much, Madam Chair. Thanks to 

the Chairs and Ranking Members for this important conversation 

and thanks to the witnesses who are here. I wish we each had five 

hours instead of five minutes because there are so many questions. 

So I wanted to start, Mr. Snell, you mentioned the issues and the 

challenges with notification and communication, and this is something that I want to recognize both in the public and private sector 

has been a challenge. And of course with the number of current 

and former federal employees, it’s my understanding that the 

FISMA requirement requires notice to affected individuals provided 

as expeditiously as practicable and without unreasonable delay. So 

those are obviously terms that are not concrete depending on the 

circumstances. I just bring this up to recognize the importance of 

communicating with people who are victims of the data breaches. 

And it’s not just an issue in the federal arena either, in the private 

sector as well. 

I want to go back to the point that was made about encryption. 

It’s my understanding that Estonia, even though it’s a small country, had a significant data breach in 2007 and has really come 

around and is now considered one of the countries that does the 

best job of protecting data. Granted it’s a smaller—much smaller 

population but they do make—heavy use of encryption. And they 

also have focused on educating the workforce. 

And I also serve on the Education Committee and I wanted to 

ask about the—whether we are really educating people who will be 

able to be the people who are preventing as well as understanding 

how we need to do this both psychologically and technically. So do 

we need to improve cybersecurity education? Are there enough opportunities for the workforce? Do we have the people we need out 

there to be able to do these jobs? I’ll start with Mr. Wilshusen. 

Dr. WILSHUSEN. Well, I think certainly improving the cybersecurity understanding and awareness on the part of the public at 

large, which I believe you’re referring to, as well as with the federal workforce, is going to be very important to address these cyber 

threats that consistently evolve and are becoming more sophisticated over time. And certainly having an awareness of that and 

what types of controls and activities one should engage in and 

should not engage in should be certainly on the minds and—of ev-
87 

eryone because each individual potentially could be the weak link 

in—which results in some sort of a computer compromise. 

Ms. BONAMICI. That’s a great point. And in your testimony you 

have this whole chart about the common adversaries and you list 

hackers and I have to say I’m a little confused as I go visit schools 

and the high schools are having these hack-a-thons and they’re 

considered positive things. So is hacker a negative connotation or 

is it a positive or is it—depends on who the hacker is? It’s a little 

confusing. 

Dr. WILSHUSEN. I guess it depends on what they’re doing with 

their hacking. You know, if they’re so-called white hackers, you 

know, but in terms of—it’s good to know how hackers and particularly those individuals with malicious intent—— 

Ms. BONAMICI. Right. 

Dr. WILSHUSEN. —operate, what types of tools they use, how— 

their modus operandi if you will in order to understand how to protect against them. And so it’s important to know that and certainly 

one of the things that information security professionals do is penetration testing and to see whether or not any organization’s information security controls are effective in keeping out hackers who 

may use similar type of techniques. 

Ms. BONAMICI. Terrific. And I wanted to ask, I guess, each of 

you. Can you talk a little bit about your—what are your two or 

three top recommendations for improving practices generally, not 

necessarily just for the federal government. Mr. Esser, what would 

be your top two or three recommendations? 

Mr. ESSER. I mean one of the things I would go back to is the 

two-factor authentication to strengthen security. It’s really necessary to implement that and not just that but I mean there’s all 

kinds of different things that need to be implemented, and the key 

I think is having, you know, security Defense in Depth I think is 

the term that’s used. 

Ms. BONAMICI. Terrific. And I want to make sure the others 

get—and I’m almost out of time. 

Mr. Snell, do you have a couple of—— 

Mr. SNELL. No, that’s not my strength so I’ll—— 

Ms. BONAMICI. Dr. Romine? 

Dr. ROMINE. Sure. I would echo, I think, that proper identity 

management is a key driver. I think it can be really beneficial. 

Good use of encryption is good for preserving the integrity or at 

least the confidentiality of data, so I would just maybe add those 

two. 

Ms. BONAMICI. And Mr. Wilshusen? 

Dr. WILSHUSEN. I would say one is addressing patches or installing critical patches and remediating known vulnerabilities. U.S. 

CERT recently came out with a technical alert that said if you address these top 30 targeted vulnerabilities, that would address up 

to 85 percent of the targeted vulnerabilities that are currently 

being used. The other thing would be improved detection and prevention capabilities because regardless of how well you protect your 

systems, it’s likely you still may be subject to attack from unknown 

vulnerabilities. 

Ms. BONAMICI. Thank you so much. I see my time is expired. I 

yield back. Thank you. 
88 

Chairwoman COMSTOCK. Thank you. And I would just take privilege to note, I know when I was visiting schools that also do the 

hacking and training them, you know, that—it’s a great growth 

area for kids to get engaged in and get educated on because there’s 

going to be lots of jobs for them in this area. And I know somebody 

who works in the business so they tell their clients if we can’t hack 

into your system, you shouldn’t hire us to protect your system because that’s part of what their job is to constantly be looking for 

the next attack, right? So that’s—thank you. 

I now recognize Mr. Abraham for five minutes. 

Dr. ABRAHAM. Thank you, Madam Chair. 

I guess first I’ll express my disappointment for the Chief Information Officer Ms. Seymour not—or declining our invitation to 

come speak here. It’s my understanding that she has extensive involvement in preparing this system. Might I suggest that if OPM 

had put extensive involvement in preventing this, we might not 

even be having this hearing. So just that as a statement. 

Mr. Wilshusen, I’m going to start with you. Has the federal government’s response to this breach in your opinion been sufficient? 

Dr. WILSHUSEN. Well, one of the responses—and I can’t necessarily speak specifically to OPM, but more broadly speaking, as 

you may know, the federal CIO issued an initiative or a proclamation known as the 30-day Cybersecurity Sprint, and indeed, you 

know, to the extent that that 30-day sprint raises awareness and 

invigorates activity towards addressing these basic security requirements included in the sprint such as installing critical patches, assuring deploying multifactor authentication, and other—resolving known vulnerabilities, that’s important. And to the extent 

that that gets done, that’s a positive. 

But where it may become detrimental if after this 30 days, which 

expires on Sunday, by the way, that the agencies and the federal 

government relaxes and thinks, okay, we’ve accomplished our goal, 

I think that’s a mistake because cybersecurity and implementing 

effective security is not a sprint; it’s a marathon. And it’s something that needs to be going on a continuous basis. And the fact 

of just going back to—possibly going back to the status quo, which 

only led to the conditions that resulted in the need for a 30-day 

sprint. 

So I would say it raised awareness. Agencies may be taking actions to improve their security, but that needs to continue in perpetuity. 

Dr. ABRAHAM. And I’ll follow up with you, Mr. Wilshusen. Knowing what you know about the cybersecurity or lack thereof of all 

our federal agencies, would you entrust any of your sensitive information with any of these agencies? 

Dr. WILSHUSEN. In some cases I have no choice because my information is at other agencies through security clearances and the 

like and through our tax systems and issuing tax returns, and so, 

yes, I do entrust personal information to agencies and that’s why 

it’s important and incumbent upon those agencies to adequately 

protect information that the American taxpayers, the American 

public entrust to it. 

Dr. ABRAHAM. And it’s my understanding that the GAO tracks 

the history of these breaches. How does this OPM recent breach 
89 

compare or where does it rank in the history of the other government breaches as far as the tracking is concerned? 

Dr. WILSHUSEN. Well, in terms of the like number of individuals 

affected by this breach— 

Dr. ABRAHAM. Right. 

Dr. WILSHUSEN. —it’s among the top. You know, a few years ago 

back I think in 2005, 2006 there was a data breach at the Department of Veterans Affairs in which the hard drive was stolen from 

an employee’s—from their home but that contained the personally 

identifiable information of 26, 27 million veterans and current service members. But that hard drive was ultimately found and determined not to have been—the information was determined not to 

have been disclosed. So that—this particular breach ranks right up 

near the top I would say. 

Dr. ABRAHAM. Mr. Esser, you said in your testimony that the 

OPM leadership has been—has not been forthright about the claim 

of proactively shutting down the e-QIP system. Can you tell us how 

long the OPM has known about these vulnerabilities to that particular one system? 

Mr. ESSER. There was a security assessment and authorization 

done on the e-QIP system in September of 2012 which identified 

18 vulnerabilities. I do not know if those vulnerabilities are related 

to the reason that the system was shut down last week but it certainly indicates that there has been vulnerabilities that OPM has 

been aware of and has not addressed even to date. 

Dr. ABRAHAM. Okay. Thank you. 

Madam Chair, I’ll yield back. 

Chairwoman COMSTOCK. Thank you, Mr. Abraham. 

Ms. Esty. 

Ms. ESTY. Thank you, Madam Chair. I want to thank you and 

Chairman Loudermilk and Ranking Members Lipinski and Beyer 

for holding today’s extremely important hearing. And as we’ve—as 

has already been noted, with three other breaches having been 

noted today in the private sector, it’s very much on all of our 

minds. 

Our national and personal security depends on a strong cybersecurity infrastructure, and the recent breaches that have been disclosed with OPM are to me particularly disturbing when I look at 

the security clearance records that could have been compromised. 

No credit check is going to make up for the risk to not just personal 

security but our nation’s security for every individual who went 

through or was consulted as part of that system. 

So I’d like you to think and maybe get back to us on what sort 

of protection and advice do we give on the national security front, 

on the security breach aspect because that is very different than 

your personal information to raid your bank account. That’s a risk 

of grave concern for this country, which we haven’t really discussed 

today. 

It seems to me a number of issues have been raised and I want 

to quickly tick them off and then focus on the last. We need to understand the extent of vulnerability and that’s been discussed at 

some length. The accountability for what’s happened also been 

raised by other Members. And I want to focus on the last two, our 

capacity to address these issues in the future. That’s a question in 
90 

part of resources and that’s been mentioned, both personnel resources—and Representative Bonamici raised an issue she and I 

share a grave concern and interest in, encouraging young people to 

pursue these fields and making sure we have enough capacity on 

both the private sector side and the public sector side. Is it a priority issue? Do we need to have different prioritization? 

But the last issue I’d really like you to respond to is how do we 

move to a continuous monitoring or effectiveness model from what 

we’ve had, which is a compliance model? It seems to me we have 

a real challenge. Congress enacts laws. Laws are about compliance. 

They are snapshots in time that reflect our knowledge and technical capabilities. But as we’ve all discussed here today, these are 

evolving risks, and the moment we stick a pin in the butterfly and 

pin it down, it will change by the time we finish pushing that pin 

in. 

So if you could discuss a little bit what can we do on the Congressional side and what can the agencies due to move to a 

mindset that is much more nimble and that is in a continuous 

mode because that’s going to be both what our hard and software 

look like but also our mindset about what compliance actually 

means. 

Dr. WILSHUSEN. I’ll take first stab if you don’t mind. 

Well, one is an initiative that’s already underway within the Department of Homeland Security as it relates to continuous 

diagnostics and mitigation, the extent to which DHS is providing 

tools that are available for agencies to implement this capability. 

Our work at the Department of State before this initiative was established showed that there are benefits to monitoring the security 

posture of an organization on a continuous basis, but there are also 

a number of challenges associated with that, some technological, 

some management and operational. 

But certainly that’s one area that can be done and indeed Congress in the passage of the Federal Information Security Modernization Act of 2014 recognized the need for continuous monitoring and identified that as one of the areas that agencies should 

be focusing on in securing their systems. And so that’s one part of 

it. 

But you’re right, I totally agree. The need for assessing and monitoring the effectiveness of security controls needs to be done on a 

continuous monitoring basis because threats change every day, the 

computing environment changes is very dynamic, and new 

vulnerabilities are being identified each time. 

Dr. ROMINE. If I may, I’d like to spotlight two things that NIST 

is doing that address two of your issues. One is we house the program office for the National Initiative for Cybersecurity Education, 

which is an interagency activity that I think is making great 

strides in addressing the workforce issue that you brought up. 

And the second is under Executive Order 13636 NIST engaged 

the private sector and other stakeholders in a year-long effort to 

develop what turned into the cybersecurity framework for improving the cybersecurity of critical infrastructures. And although that 

was the focus, it has turned out that that report that we developed 

the framework is a model I think for establishing or improving a 

cybersecurity approach whether it’s in the private sector or the 
91 

public sector or other areas. It’s a very dynamic approach that involves, you know, a development of maturity along the lines of— 

analogous to a maturity model and so I think that could be really 

beneficial. 

Chairwoman COMSTOCK. Okay. Thank you. 

Ms. ESTY. I see my time is expired. 

Chairwoman COMSTOCK. We want to be able to squeeze in our 

last two folks here. 

Mr. Palmer, I recognize you for five minutes. 

Mr. PALMER. Thank you, Madam Chairman. 

We’ve talked about Defense in Depth and the hardware but I 

want to talk about the individuals involved. 

Dr. Wilshusen, OPM and the Department of Homeland Security 

officials stated that the attackers who reached OPM’s systems may 

have been aided by user credentials that were obtained or stolen 

from one of OPM’s contractors. Andy Ozment testified before the 

Oversight Committee that part of this breach may have occurred 

through social engineering. I want to know in your opinion what 

agencies can do to ensure that their IT contractors are effectively 

protecting federal systems and information? I mean I fully get it 

that we need to completely overhaul our hardware and software, 

but that alone in the context of Defense in Depth will not secure 

the system. 

Dr. WILSHUSEN. I wholeheartedly agree. The oversight of contractors and their information security practices over systems that they 

operate on behalf of the federal government or operate to process 

information on behalf of the federal government is really critical to 

assure that—agencies need to assure that that information is being 

adequately protected. And that requires that they go in and assess 

or have an independent assessor evaluate the security controls and 

assure that they’re being operated effectively and efficiently and 

that indeed the requirements for information security are expressed to the contractor either through contractual instruments or 

other mechanisms to assure that they know what is required to 

help protect those systems. 

And another point you raised in terms of—was the stolen user 

credentials that might have been used to help promote or facilitate 

the attack on OPM, one of the things that could help there is having multifactor authentication, which would help to either prevent 

or at least raise the bar significantly for that attacker to be able 

to use compromised credentials. And that wasn’t in place in all 

places throughout OPM. 

Mr. PALMER. Well, it’s even worse than that. Dr. Ozment—it 

wasn’t in his testimony but in an interview—talked about the fact 

that one of the contractors working with OPM was based in Argentina and was working with two people who were Republic of China 

nationals. I mean how do we let something like that happen? I 

mean with the amount of cyber assault—I visited a facility that 

monitors these cyber attacks and you can literally see them being 

launched. There were 700 and something cyber attacks launched 

from Russia with 10 minutes. China was a distant second. 

How is it that we would not be aware that we had people foreignbased involved in this and particularly a couple of Chinese nationals? 
92 

Dr. WILSHUSEN. I guess I’m not familiar with that particular situation so I don’t know if I can really comment to that, so—— 

Mr. PALMER. But I think you would agree, though, that that’s a 

pretty egregious oversight or failure to exercise oversight over our 

systems? 

Dr. WILSHUSEN. I think it’s important that agencies understand 

who has access to their systems and are accessing their systems 

and that kind of gets back to the identity management area that 

we—the panel spoke about earlier. So that certainly is one specific 

point to that. 

Mr. PALMER. Mr. Snell, I want to ask you something here. Mr. 

Abraham brought up the fact that Ms. Seymour did not want to 

testify before this committee. When she testified before the Oversight Committee, I asked her if the breach was limited only to people who filled out the Standard Form 86, the security background 

check, because that was I think the position that OPM had taken. 

It turns out that it extends beyond that. Two of my staff who have 

never filled out an SF 86, who have never served in the executive 

branch, both got letters telling them that their personal data had 

been compromised. 

Do you have an idea of how broad this is and does it extend beyond current federal employees to retired employees? Is it possible 

that it would extend to civilians who have national security clearances? 

Mr. SNELL. That’s entirely possible. We don’t have firsthand information. We only know what’s being reported out of OPM and it’s 

not very much. It’s not very helpful what they’re reporting as far 

as numbers but it’s entirely—and it has been I think in the media 

mentioned that it could be contractors, as well as federal employees, former employees, people who are no longer in the federal government. So I’d have to turn that back over to the Office of Personnel Management to come forth with information letting us know 

exactly who the victims of these breaches are. 

Mr. PALMER. Madam Chairman, I yield the balance of my time. 

Thank you. 

Chairwoman COMSTOCK. Thank you. 

And I now recognize five minutes for Mr. Tonko. 

Mr. TONKO. Thank you, Madam Chair. 

The—being a former federal employee, Mr. Snell, what are the 

kinds of communication that you would like to see happen? 

Mr. SNELL. Well, in a situation like this I would like to see the 

communication be sent via letter with OPM agency seal on it so 

that the individuals would be able to at least feel confident that 

this is an official U.S. Government notice. And that kind of—I 

know it’s not efficient in today’s email world and all of that, but 

in a case like this where we have the credibility issue as to who 

do you trust, who do you don’t trust, I think a letterhead—OPM 

letterhead or an agency letterhead would have gone a lot further 

to helping folks believe what they’re getting is bona fide. So I like 

that like that kind of communication. 

Mr. TONKO. Thank you. 

And Mr. Esser, the review here that was done would obviously 

involve the private sector, right, with contractors serving the fed-
93 

eral government with some of the reinforcement here? How—was 

there any review done of that private sector element? 

Mr. ESSER. I’m not sure I understand what review you’re referring to. 

Mr. TONKO. Well, just with the outcome that we had in the situation, were contractors reviewed in this situation that served the 

federal agencies? 

Mr. ESSER. I’m sorry. I guess I still don’t quite understand the 

question. What review are you referring to? 

Mr. TONKO. Just the malfunctioning that occurred. As we look 

over the situation and try to determine where the weaknesses in 

the system are, what—is there a role that the contractors to the 

system might have played here or that could have been better collaboration involved in this system? Were there any recommendations that you could make in that regard? 

Mr. ESSER. If—I mean we in the IG office, when we do our reviews, certainly there’s contractor-operated systems at OPM and 

we look at those the same way we look at the agency-operated systems. I mean there’s a number of contractors that are working at 

OPM and likely at many other agencies as well. They, I believe, are 

treated the same way as federal employees in how we conduct our 

reviews. 

Mr. TONKO. And in those reviews was there a need for better collaboration in this whole process where there could have been perhaps a stronger partnership with those efforts? 

Mr. ESSER. I don’t believe we reported any issues in that area. 

Mr. TONKO. And to any of you on the panel, when we look at a 

situation like this, is there a concern for the amount of available 

resources to an agency to prevent any of this activity? Is it a function of lack of resources or how those resources have been shared? 

Would any of you comment on, you know, weak investment or falling short in the resources we require? 

Dr. WILSHUSEN. You know, broadly speaking, not just talking to 

OPM but across the federal government, many of the security control deficiencies and weaknesses that we identified during our audits are more of an information security management process more 

than a lack of resources in terms of implementing effectively and 

consistently across an agency its own defined and developed policies and procedures. 

For example, one basic control is just installing patches on a 

timely manner, particularly those that have been rated as critical. 

Agencies often have policies that state they need to be installed 

within a certain period of time, usually within a week or a couple 

weeks, but we find that sometimes those patches are not being installed for months and sometimes over years. So, in part it’s a 

management issue to make sure that these key security control 

issues and controls are being effectively implemented. 

There are also resource implications as well. In some cases it 

may be important for agencies to implement new technologies or 

tools, particularly with respect to installing intrusion detection capabilities within their networks to identify those types of 

vulnerabilities or cyber attacks or intrusions that do inevitably 

occur. 
94 

Mr. TONKO. Thank you very much. I see my time is out. Thank 

you, Madam Chair. 

Chairwoman COMSTOCK. Thank you. And we do have a vote now 

and so I just want to thank the witnesses for their very valuable 

testimony today. Sorry we had to sandwich it in between our votes 

because I know myself and my colleagues could spend a lot more 

time talking with you about this and will be talking with you and 

asking for any guidance that you can give us with your expertise. 

So we very much appreciate you coming before us. 

The record will remain open for two weeks for additional comments and written questions from the Members. 

And so the witnesses are excused and we thank you again for 

your expert testimony. And this hearing is adjourned. 

[Whereupon, at 5:19 p.m., the Subcommittees were adjourned.] 
(95) 

Appendix I 

ANSWERS TO POST-HEARING QUESTIONS
96 

ANSWERS TO POST-HEARING QUESTIONS

Responses by Mr. Michael R. Esser 
97 
98 
99 
100 

Responses by Mr. David Snell 
101 
102 
103 
104 
105 

Responses by Dr. Charles Romine 
106 
107 
108 
109 

(111) 

Appendix II 

ADDITIONAL MATERIAL FOR THE RECORD
112 

PREPARED STATEMENT OF COMMITTEE RANKING MEMBER

EDDIE BERNICE JOHSNON

Thank you Chairwoman Comstock and Chairman Loudermilk for holding this 

hearing on the recent OPM data breach. 

Even though we will continue to learn more details about the breach, we already 

know that millions of Americans’ personal information was compromised. This number includes current and retired federal employees as well as the family members, 

friends, and co-workers of federal employees. 

There are valid concerns about hackers using this data for criminal purposes. Additionally, since security clearance background investigation information was compromised, there are also serious national security concerns. 

It is frustrating to learn that OPM knew that they had serious information security systems problems long before this breach. Although addressing their information security systems is a top goal of the new OPM leadership, it is clear that action 

should have been taken years ago. 

Federal computer information systems are guided by FISMA. In this risk management approach, agencies evaluate the type of data in their systems, determine what 

level of controls are needed, and put together a plan to adequately protect their 

data. 

Although NIST is responsible for drafting the standards used by the agencies, 

they do not oversee the program and are not responsible for enforcing agency compliance with FISMA. 

Instead of picking on one federal agency, it is my hope that we can use this data 

breach as a starting point for addressing federal cybersecurity more broadly. What 

is working? What is not? What mechanisms need to be in place to better protect 

individuals’ personal information on our federal systems? 

I want to end by saying that any conversation about federal cybersecurity must 

include a discussion about resources. It would be irresponsible for us to mandate 

additional cybersecurity measures that federal agencies must take without providing them with additional resources. 

Cybersecurity will always be about managing risks. No information security system, whether public sector or private sector, can be completely protected. And unfortunately the question is, when, not if a system will get hacked. Therefore, we must 

ensure that we have the appropriate policies and oversight in place to help federal 

agencies protect their data, and that we have provided federal agencies with the resources they need to do the job effectively. 

I want to thank the witnesses for their testimony and I yield back the balance 

of my time. 
113 

LETTER SUBMITTED BY REPRESENTATIVE BARBARA COMSTOCK
114 
115 
116 
117 
118 
119 
120 
121 

Æ