U.S. GOVERNMENT PUBLISHING OFFICE

31–105 PDF WASHINGTON : 2018

STATE OF PLAY: FEDERAL IT IN 2018 

JOINT HEARING 

BEFORE THE

SUBCOMMITTEE ON 

INFORMATION TECHNOLOGY 

AND THE

SUBCOMMITTEE ON 

GOVERNMENT OPERATIONS 

OF THE

COMMITTEE ON OVERSIGHT 

AND GOVERNMENT REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

SECOND SESSION 

MARCH 14, 2018 

Serial No. 115–75 

Printed for the use of the Committee on Oversight and Government Reform 

( 

Available via the World Wide Web: http://www.fdsys.gov 

http://oversight.house.gov 


KING-6430 with DISTILLER
(II) 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

Trey Gowdy, South Carolina, Chairman 

John J. Duncan, Jr., Tennessee 

Darrell E. Issa, California 

Jim Jordan, Ohio 

Mark Sanford, South Carolina 

Justin Amash, Michigan 

Paul A. Gosar, Arizona 

Scott DesJarlais, Tennessee 

Blake Farenthold, Texas 

Virginia Foxx, North Carolina 

Thomas Massie, Kentucky 

Mark Meadows, North Carolina 

Ron DeSantis, Florida 

Dennis A. Ross, Florida 

Mark Walker, North Carolina 

Rod Blum, Iowa 

Jody B. Hice, Georgia 

Steve Russell, Oklahoma 

Glenn Grothman, Wisconsin 

Will Hurd, Texas 

Gary J. Palmer, Alabama 

James Comer, Kentucky 

Paul Mitchell, Michigan 

Greg Gianforte, Montana 

Elijah E. Cummings, Maryland, Ranking 

Minority Member 

Carolyn B. Maloney, New York 

Eleanor Holmes Norton, District of Columbia 

Wm. Lacy Clay, Missouri 

Stephen F. Lynch, Massachusetts 

Jim Cooper, Tennessee 

Gerald E. Connolly, Virginia 

Robin L. Kelly, Illinois 

Brenda L. Lawrence, Michigan 

Bonnie Watson Coleman, New Jersey 

Raja Krishnamoorthi, Illinois 

Jamie Raskin, Maryland 

Jimmy Gomez, Maryland 

Peter Welch, Vermont 

Matt Cartwright, Pennsylvania 

Mark DeSaulnier, California 

Stacey E. Plaskett, Virgin Islands 

John P. Sarbanes, Maryland 

SHERIA CLARKE, Staff Director 

WILLIAM MCKENNA, General Counsel 

MEGHAN GREEN, Counsel 

TROY STOCK, Information Technology Subcommittee Staff Director 

JULIE DUNNE, Government Operations Subcommittee Staff Director 

SHARON CASEY, Deputy Chief Clerk 

DAVID RAPALLO, Minority Staff Director 


KING-6430 with DISTILLER
(III) 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY

Will Hurd, Texas, Chairman 

Paul Mitchell, Michigan, Vice Chair 

Darrell E. Issa, California 

Justin Amash, Michigan 

Steve Russell, Oklahoma 

Blake Farenthold, Texas 

Greg Gianforte, Montana 

Robin L. Kelly, Illinois, Ranking Minority 

Member 

Jamie Raskin, Maryland 

Stephen F. Lynch, Massachusetts 

Gerald E. Connolly, Virginia 

Raja Krishnamoorthi, Illinois 

SUBCOMMITTEE ON GOVERNMENT OPERATIONS

Mark Meadows, North Carolina, Chairman 

Jody B. Hice, Georgia, Vice Chair 

Jim Jordan, Ohio 

Mark Sanford, South Carolina 

Thomas Massie, Kentucky 

Ron DeSantis, Florida 

Dennis A. Ross, Florida 

Rod Blum, Iowa 

Gerald E. Connolly, Virginia, Ranking 

Minority Member 

Carolyn B. Maloney, New York 

Eleanor Holmes Norton, District of Columbia 

Wm. Lacy Clay, Missouri 

Brenda L. Lawrence, Michigan 

Bonnie Watson Coleman, New Jersey 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(V) 

C O N T E N T S 

Page 

Hearing held on March 14, 2018 ............................................................................ 1 

WITNESSES 

Mr. David Powner, Director of IT Management Issues, U.S. Government 

Accountability Office 

Oral Statement ................................................................................................. 3 

Written Statement ............................................................................................ 6 

The Honorable Margaret Weichert, Deputy Director for Management, Office 

of Management and Budget 

Oral Statement ................................................................................................. 47 

Written Statement ............................................................................................ 49 

Mr. Bill Zielinski, Deputy Assistant Commissioner of the IT Category, U.S. 

General Services Administration 

Oral Statement ................................................................................................. 59 

Written Statement ............................................................................................ 61 

The Honorable Jeanette Manfra, Assistant Secretary for the Office of 

Cybersecurity and Communications, U.S. Department of Homeland Security 

Oral Statement ................................................................................................. 66 

Written Statement ............................................................................................ 68 

APPENDIX 

Response from Ms. Weichert, OMB, to Questions for the Record ....................... 92 

Response from Mr. Zielinski, GSA, to Questions for the Record ......................... 94 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(1) 

STATE OF PLAY: FEDERAL IT IN 2018 

Wednesday, March 14, 2018 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY, JOINT

WITH THE SUBCOMMITTEE ON GOVERNMENT OPERATIONS, 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM, 

Washington, D.C. 

The subcommittees met, pursuant to call, at 3:16 p.m., in Room 

2154, Rayburn House Office Building, Hon. Will Hurd [chairman of 

the Subcommittee on Information Technology] presiding. 

Present from the Subcommittee on Information Technology: Representatives Hurd, Gianforte, Kelly, and Krishnamoorthi. 

Present from the Subcommittee on Government Operations: Representatives Hice, Blum, Connolly, and Maloney. 

Mr. HURD. The Subcommittee on Information Technology and the 

Subcommittee on Government Operations will come to order. 

And, without objection, the presiding member is authorized to declare a recess at any time. 

Good afternoon. Sorry for the wait, but it is Washington, D.C. 

And the House of Congress is the people’s House, but sometimes 

we get a little delayed. 

We have had momentum over the last couple years. I think this 

year, or this Congress, with the Federal IT modernization effort 

through the passage of the MGT Act, the Modernizing Government 

Technology Act, we have gained strength and force. This, now a 

law, is bipartisan legislation that will, for the first time, reward 

and incentivize Federal agencies and CIOs to cut costs and invest 

in cutting-edge technology. 

The effort, also, of modernization has gained momentum from 

Trump administration initiatives like establishing the Office of 

American Innovation, releasing an IT modernization report, and retaining good ideas from the previous administration, including the 

U.S. Digital Service. 

I am concerned, however, that in some areas we have lost momentum. We went too long without a Federal CIO. I am glad Ms. 

Kent is now in the position and look forward to having her up here 

before the committee within the next few months. 

I am also pleased that Ms. Weichert is in place as the Deputy 

Director for Management at OMB. 

I have spoken to my former colleague, Director Mulvaney, about 

our efforts here in the subcommittee and how we can work together 

to modernize government. He is an enthusiastic supporter of using 

emerging technologies to make government more efficient and accountable. 


KING-6430 with DISTILLER
2 

We need to rethink how we structure the Federal workforce, to 

ensure the Federal Government has access to smart, well-trained 

IT and cybersecurity professionals, and be working in a bipartisan 

fashion, as always, in introducing a bill in the coming months to 

establish the U.S. cyber reserves, a public/private-sector rotational 

workforce. I look forward to the witnesses’ thoughts on how to best 

organize and structure this kind of workforce. 

I also continue to have concerns about longstanding GAO recommendations that remain unaddressed, oftentimes year after year 

after year. These open, lingering vulnerabilities put us at incredible 

risk, as we saw with the devastating data breach at OPM, which 

it is crazy to think was almost 3 years ago. 

I want to hear from GAO their most critical open recommendations and, from the rest of the witnesses, concrete plans to close 

them. Let’s use this hearing to ensure IT modernization across the 

Federal Government continues, even with more force and strength, 

in 2018. Let’s not lose the momentum. 

And, as always, it is an honor to be exploring these very important issues in a bipartisan fashion with my friend, the ranking 

member, the one and only, the Honorable Robin Kelly from Illinois. 

Ms. KELLY. Thank you, Mr. Chairman. Thank you for calling today’s hearing on the Federal Government’s information technology. 

These two subcommittees have prioritized holding agencies accountable for their compliance with the Federal Information Technology Acquisition Reform Act in the effort to modernize our legacy 

IT systems. We have managed to work in a bipartisan manner not 

only to conduct oversight but to introduce legislation seeking to address the Nation’s IT and cybersecurity problems. 

Improving the efficiency and security of the Federal Government’s IT system is essential to our Nation’s security. In order to 

improve the efficiency and security, we must modernize legacy IT 

systems across every Federal agency. 

The Federal Government spends nearly $60 billion just to sustain its existing outdated IT. When agencies must spend 75 percent 

of their IT budgets merely to maintain legacy systems, they predictably fall behind in the effort to modernize. 

That is why the Modernizing Government Technology Act of 

2017 is critical to shoring up our Nation’s cybersecurity and moving 

us forward. MGT is now law. It creates a working capital fund 

called the Technology Modernization Fund that will have money for 

efforts like cloud migration for agency CIOs to think creatively 

about modernization. 

The next couple of months will determine whether the MGT Act 

is allowed to spur that type of innovation. I was pleased to see that 

the President’s proposal budget called for $228 million for the modernization fund. OMB Director Mulvaney recently released a memo 

to agencies with guidance on MGT’s implementation. 

The board overseeing the modernization fund is in place. It is 

now up to Congress to fund this important effort. Our government 

technology is too outdated to allow this opportunity to pass us by. 

By allocating these funds, we further our goals under FITARA to 

fully empower agency CIOs. I view the MGT Act as a natural complement of FITARA. We cannot speak about important efforts, like 


KING-6430 with DISTILLER
3 

moving to the cloud and data center consolidations, without providing the funding necessary to make that happen. 

In addition to modernizing our technology, we must modernize 

our Federal workforce to make sure they have the tools and skills 

necessary to address the problems of not only today but tomorrow. 

In 2016, GAO found that the evolving array of cyber-based 

threats continue to pose a risk to our national security. The government’s inability to attract and retain qualified cyber professionals 

throughout the government threatens our ability to address these 

cyber threats. Therefore, attracting IT and cybersecurity talent is 

critical to the safety of every American and the security of our 

country. 

I hope that our witnesses can update us on the state of the Federal IT and how each agency plans to address the opportunities 

and challenges facing the Federal Government. 

Thank you, Mr. Chairman. 

Mr. HURD. Thank you, Ranking Member Kelly. 

And when the ranking member and chair of Government Operations get here, we will allow them to have opening remarks, if 

they do. But now it is a pleasure to introduce our witnesses. 

Mr. David Powner, probably our most visits to this committee of 

anybody in government. Thanks for being here. And he is the Director of IT Management Issues at GAO. 

The Honorable Margaret Weichert, Deputy Director for Management at the Office of Management and Budget. Thank you for 

being here. 

Mr. Bill Zielinski, Deputy Assistant Commissioner of the IT Category at the General Services Administration. 

And last but not least, the Honorable Jeanette Manfra, Assistant 

Secretary for the Office of Cybersecurity and Communications at 

the Department of Homeland Security. 

Welcome to you all. And pursuant to committee rules, all witnesses will be sworn in before you testify, so please stand and raise 

your right hand. 

Do you solemnly swear or affirm the testimony you are about to 

give is the truth, the whole truth, and nothing but the truth, so 

help you God? 

Thank you. 

Please let the record reflect that the witnesses answered in the 

affirmative. 

In order to allow time for discussion, please limit your opening 

remarks to 4 minutes. Your entire written statement will be part 

of the record. 

And as a reminder, the clock in front of you shows the remaining 

time during your opening statement. The light will turn yellow 

when you have 30 seconds left and red when your time is up. 

Please also remember to press the button for the speaker. 

So, with that, Mr. Powner, welcome back. 

WITNESS STATEMENTS 

STATEMENT OF DAVID POWNER 

Mr. POWNER. Chairman Hurd, Ranking Member Kelly, and members of the subcommittee, I would like to commend your subVerDate Nov 24 2008 10:37 Sep 04, 2018 Jkt 000000 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 H:\31105.TXT APRIL

KING-6430 with DISTILLER
4 

committee for your consistent and thorough oversight of IT and 

cybersecurity issues, in particular with FITARA and with recently 

moving the FITARA Enhancement Act and MGT. 

This afternoon, I will highlight top priorities for OMB and agencies. My comments will address three broad areas: human capital, 

acquisitions, and operations. 

CIO authorities still need to be strengthened, despite significant 

improvements from FITARA. Your push to elevate these positions 

at departments and agencies is still needed. Currently, 13 of the 

24 CIOs report to the DEPSEC or higher. OMB plays a critical role 

here, especially with the recent focus on agency reorganizations. 

Also, cybersecurity and IT workforce needs to be further 

strengthened. Specifically, we still need to properly identify and 

tackle our workforce gaps. Properly addressing many of these 

needs with contractors is a critical part of the solution here. GAO 

has ongoing government-wide reviews looking at both the 

cybersecurity and IT workforce needs. 

Turning to improvements on major acquisitions, we still need to 

stay the course with major provisions in FITARA. This starts with 

incremental development. Your scorecard shows major progress in 

this area, but we still have too many projects not tackling this in 

manageable segments. 

We also need to have IT shops aware of IT contracts so that we 

can avoid duplication and to ensure the right governance over 

these acquisitions. A recent contracting review was discouraging, 

as only one-third of the agencies had a process to approve IT contracts consistent with FITARA and OMB guidance. 

And of our sample of almost 100 contracts, only 10 percent were 

approved by CIOs or their designee. Strengthening the relationship 

between CIOs and chief acquisition officers is needed. 

We also believe the Nation’s top Federal IT acquisitions should 

have OMB governance over them in addition to agency governance. 

The top acquisitions should include VA and DOD’s EHR acquisitions, IRS’s K–2 project, SSA’s disability case processing system, 

and FAA’s NextGen acquisitions. 

The reason these acquisitions need OMB’s attention is because 

these agencies, left alone, haven’t managed them well. The administration’s attention to VA’s EHR solution is spot-on; we just need 

more of this. We have a review underway where we are identifying 

and profiling these most critical acquisitions. 

Regarding operational systems, again, we need to stay the course 

with FITARA. Data center optimization metrics provide great 

transparency on where agencies are at with their optimization 

metrics. And extending the sunset date from 2018 to 2020 will give 

agencies more time to both optimize and save. 

A couple key points here: Savings still can be significant as we 

optimize space and equipment. And the MGT working capital funds 

can be used to invest in unfunded priorities. 

Also, these agencies who can’t optimize by 2020 need to get out 

of the data center business. We plan to report annually through 

2020 on agencies’ data center progress. 

We also believe that the Nation’s most mission-critical legacy 

systems that are costly to maintain and pose significant cyber risk 


KING-6430 with DISTILLER
5 

due to unsupported software need to be replaced with modern, secure technologies and ultimately decommissioned. 

OMB needs to have an active role here to ensure that these old 

systems, like VA’s VistA system and IRS’s Individual Master File, 

have plans to replace and decommission. 

The administration’s recent modernization strategy was solid on 

network modernization, shared services, and cyber but light on 

tackling these most challenging modernization efforts. CIOs with 

average tenures of 2 years don’t always focus on these longer-term, 

challenging legacy systems, which is even more reason for OMB to 

drive this. We have a review underway where we are identifying 

and profiling these legacy systems most in need of modernization. 

In conclusion, the American Tech Council, the Office of Innovation, and the modernization strategy are all positive developments. 

Now we need more action and implementation from OMB and 

agencies. 

Key focus areas should be on fixing CIO authorities in the IT 

workforce; regarding acquisitions: incremental development, CIO 

alignment with acquisitions, and the focus on our Nation’s top acquisitions is needed. On the operations side, data center optimization and mission-critical legacy modernization need continued attention. 

Finally, the Comptroller General held a forum with prior Federal 

and agency CIOs from previous administrations in late 2016 to explore what has worked over the years in Federal IT. The results 

of this forum, summarized on page 10 of my written statement, are 

consistent with the comments here this afternoon and highlight the 

critical role OMB leadership plays. 

Mr. Chairman, again, thank you for your oversight of Federal IT. 

[Prepared statement of Mr. Powner follows:] 


KING-6430 with DISTILLER
6 


KING-6430 with DISTILLERInsert offset folio 1 here 31105.001
7 


KING-6430 with DISTILLERInsert offset folio 2 here 31105.002
8 


KING-6430 with DISTILLERInsert offset folio 3 here 31105.003
9 


KING-6430 with DISTILLERInsert offset folio 4 here 31105.004
10 


KING-6430 with DISTILLERInsert offset folio 5 here 31105.005
11 


KING-6430 with DISTILLERInsert offset folio 6 here 31105.006
12 


KING-6430 with DISTILLERInsert offset folio 7 here 31105.007
13 


KING-6430 with DISTILLERInsert offset folio 8 here 31105.008
14 


KING-6430 with DISTILLERInsert offset folio 9 here 31105.009
15 


KING-6430 with DISTILLERInsert offset folio 10 here 31105.010
16 


KING-6430 with DISTILLERInsert offset folio 11 here 31105.011
17 


KING-6430 with DISTILLERInsert offset folio 12 here 31105.012
18 


KING-6430 with DISTILLERInsert offset folio 13 here 31105.013
19 


KING-6430 with DISTILLERInsert offset folio 14 here 31105.014
20 


KING-6430 with DISTILLERInsert offset folio 15 here 31105.015
21 


KING-6430 with DISTILLERInsert offset folio 16 here 31105.016
22 


KING-6430 with DISTILLERInsert offset folio 17 here 31105.017
23 


KING-6430 with DISTILLERInsert offset folio 18 here 31105.018
24 


KING-6430 with DISTILLERInsert offset folio 19 here 31105.019
25 


KING-6430 with DISTILLERInsert offset folio 20 here 31105.020
26 


KING-6430 with DISTILLERInsert offset folio 21 here 31105.021
27 


KING-6430 with DISTILLERInsert offset folio 22 here 31105.022
28 


KING-6430 with DISTILLERInsert offset folio 23 here 31105.023
29 


KING-6430 with DISTILLERInsert offset folio 24 here 31105.024
30 


KING-6430 with DISTILLERInsert offset folio 25 here 31105.025
31 


KING-6430 with DISTILLERInsert offset folio 26 here 31105.026
32 


KING-6430 with DISTILLERInsert offset folio 27 here 31105.027
33 


KING-6430 with DISTILLERInsert offset folio 28 here 31105.028
34 


KING-6430 with DISTILLERInsert offset folio 29 here 31105.029
35 


KING-6430 with DISTILLERInsert offset folio 30 here 31105.030
36 


KING-6430 with DISTILLERInsert offset folio 31 here 31105.031
37 


KING-6430 with DISTILLERInsert offset folio 32 here 31105.032
38 


KING-6430 with DISTILLERInsert offset folio 33 here 31105.033
39 


KING-6430 with DISTILLERInsert offset folio 34 here 31105.034
40 


KING-6430 with DISTILLERInsert offset folio 35 here 31105.035
41 


KING-6430 with DISTILLERInsert offset folio 36 here 31105.036
42 


KING-6430 with DISTILLERInsert offset folio 37 here 31105.037
43 


KING-6430 with DISTILLERInsert offset folio 38 here 31105.038
44 


KING-6430 with DISTILLERInsert offset folio 39 here 31105.039
45 


KING-6430 with DISTILLERInsert offset folio 40 here 31105.040
46 


KING-6430 with DISTILLERInsert offset folio 41 here 31105.041
47 

Mr. HURD. Thanks for being an important partner on this. 

And I misspoke. I apologize. Everybody has 5 minutes. 

So, Ms. Weichert, you are now up for your 5 minutes. 

STATEMENT OF THE HONORABLE MARGARET WEICHERT 

Ms. WEICHERT. Thank you very much. It’s great to be here on Pi 

Day to talk about this important subject. 

So, Chairman Hurd, Ranking Member Kelly, and members of the 

subcommittees, thank you for the opportunity to appear before you 

today to discuss the state of Federal information technology in 

2018. 

In December, in testifying before the Senate Committee on 

Homeland Security and Governmental Affairs, I discussed the 

range of disciplines that the Deputy Director for Management is 

charged with overseeing, including IT, information security, human 

capital management, finance, accounting, performance management, and procurement. 

Today, as the newly sworn-in Deputy Director for Management, 

I’m working with our agency partners to drive necessary improvement in those disciplines. And I’m excited to talk about one of 

those areas, IT modernization, in depth. 

Improving our technology infrastructure is fundamental to aligning the executive branch to the mission, service, and stewardship 

needs of the 21st century. To that end, next week, we will release 

the President’s Management Agenda, the PMA, an agenda which 

places IT modernization at its core. 

The PMA sets out a long-term vision for more effective government that better achieves missions and enhances the key services 

upon which the American people depend. IT modernization must 

provide the essential backbone of the government service delivery 

while keeping sensitive data and systems secure. And the President’s Management Agenda also links to related critical issues associated with data accountability and transparency as well as the 

people and workforce for the 21st century. 

Since the establishment of the Office of E–Government and Information Technology in 2002, OMB has played a pivotal role in formulation of IT policy and strategic direction across the Federal 

Government. The Office of the Federal CIO, the Chief Information 

Security Office of the U.S., and the United States Digital Service 

are all in my organization. And, together, these groups leverage the 

convening authorities of OMB, including the CIO Council and the 

CISO Council, to coordinate executive-branch IT modernization activities. 

In addition, since 2014, U.S. Digital Service has been focused on 

improving and transforming the experience of Americans who 

interact with government online. This means that more citizens 

can easily and seamlessly access government services online due to 

more secure identity-proofing. It means veterans are receiving appeals responses in a more timely manner. It has enhanced Medicare claims processing, allowing citizens to access health data online. And USDS has also helped made it easier for small businesses 

to compete for government contracts and for acquisition officers to 

be better positioned to acquire commercial technology. Ultimately, 


KING-6430 with DISTILLER
48 

all this work is part of a broader strategy to help rebuild Americans’ trust in government. 

Today, I look forward to talking with you about a range of IT 

modernization initiatives, including the IT modernization report, 

the Modernizing Government Technology Act, Federal 

cybersecurity policy, agency IT transformation activities, including 

the work of U.S. Digital Service, and the IT workforce of the future, to name a few areas. More detailed background on many of 

these topics is included in my written testimony for the record. 

And, in closing, OMB looks forward to working with the Oversight and Government Reform Committee and with Congress 

broadly on IT modernization. Over the years, this oversight committee has been instrumental in driving Federal IT modernization 

through its role in developing legislation such as FITARA, the 

DATA Act, and the MGT Act. Through our collaborative efforts, I 

know we will be able to improve government services and 

cybersecurity. 

I thank the subcommittees for holding this hearing and for your 

commitment to IT modernization. I will be pleased to answer any 

questions you have. 

[Prepared statement of Ms. Weichert follows:] 


KING-6430 with DISTILLER
49 


KING-6430 with DISTILLERInsert offset folio 42 here 31105.042
50 


KING-6430 with DISTILLERInsert offset folio 43 here 31105.043
51 


KING-6430 with DISTILLERInsert offset folio 44 here 31105.044
52 


KING-6430 with DISTILLERInsert offset folio 45 here 31105.045
53 


KING-6430 with DISTILLERInsert offset folio 46 here 31105.046
54 


KING-6430 with DISTILLERInsert offset folio 47 here 31105.047
55 


KING-6430 with DISTILLERInsert offset folio 48 here 31105.048
56 


KING-6430 with DISTILLERInsert offset folio 49 here 31105.049
57 


KING-6430 with DISTILLERInsert offset folio 50 here 31105.050
58 


KING-6430 with DISTILLERInsert offset folio 51 here 31105.051
59 

Mr. HURD. Thank you. 

Mr. Zielinski, you are now recognized for 5 minutes. 

STATEMENT OF BILL ZIELINSKI 

Mr. ZIELINSKI. Great. Good afternoon, Chairman Hurd, Ranking 

Member Kelly, and members of the subcommittee. My name is Bill 

Zielinski, and I am the Deputy Assistant Commissioner for the Office of Information Technology Category in GSA’s Federal Acquisition Service. In addition, I also serve as the Office of Management 

and Budget-appointed government-wide IT category manager. 

I am pleased to be here today to discuss the important role GSA 

plays in Federal information technology efforts government-wide. 

The IT Category at GSA enables agencies in the acquisition of 

$50 billion in goods and services annually from more than 20,000 

industry partners. ITC’s top priority is to maximize customer value 

and mission productivity. 

And while GSA brings significant capabilities to the table in facilitating the modernization of the Federal Government’s IT infrastructure and applications, it’s through the strategic partnerships 

with other agencies and our industry partners where we will make 

the greatest progress. 

For instance, I work closely with OMB’s Office of Federal Procurement Policy and administrator of the Office of Electronic Government to review the Federal IT spend, determine where opportunities exist to collaborate on the acquisition of IT products and 

services, and implement strategies to get more value from IT dollars. 

In that vein, I would now like to discuss four key ways in which 

GSA is supporting the modernization of the Federal Government’s 

IT infrastructure and applications. 

First, in December, the American Technology Council issued its 

final report to the President on Federal IT modernization. The report is the culmination of a months-long process to develop a strategic plan that approves the security posture of Federal IT and incorporates feedback from industry and members of the public. 

The report has three key objectives that will inform future efforts: to reduce the Federal attack surface through enhanced application and data-level protections; to improve visibility beyond the 

network level; and to ensure that policy, resource allocation, acquisition, and operational approaches to security enable the use of 

new technology without sacrificing reliability or performance. 

GSA is directly tasked, in whole or in part, with half of the 50 

action items recommended by the report and is actively working on 

these deliverables in accordance with report timelines. 

Second, the MGT Act is another critical tool for modernizing Federal IT. GSA thanks the members of these subcommittees for their 

dedication to getting this legislation passed. 

GSA is tasked with several key actions related to the MGT’s 

Technology Modernization Fund. Chief among them is providing 

broad support for the Technology Modernization Board’s activities, 

including technical support and the monitoring of agencies that receive funds from the TMF. Subject to appropriations, the GSA is 

prepared to help administer this critically important fund. 


KING-6430 with DISTILLER
60 

Third, in partnership with the White House Office of American 

Innovation, GSA is working to establish five new centers of excellence. The COEs will house centralized function-specific talent, 

products, and acquisition vehicles. These teams will provide expert 

advice, development resources, and support solution implementation in the areas of cloud adoption, IT infrastructure optimization, 

customer experience, service delivery analytics, and contact centers. The first client agency for the COEs is the United States Department of Agriculture. 

Finally, GSA is helping agencies adopt new approaches for buying commercial off-the-shelf and as-a-service solutions. By leading 

in the development of modular contracting approaches to enable 

agile and efficient development of complex, new requirements, we 

are able to assist agencies through the entire lifecycle of procurement and system development. 

GSA’s unique mix of talent and expertise in acquisition technology and service delivery, combined with our government-wide 

scope and scale, makes our agency an agent of transformation in 

how agencies will buy, build, and use technology. 

I want to thank you for the opportunity to appear before you 

today to discuss GSA’s role, and I look forward to answering your 

questions. 

[Prepared statement of Mr. Zielinksi follows:] 


KING-6430 with DISTILLER
61 


KING-6430 with DISTILLERInsert offset folio 52 here 31105.052
62 


KING-6430 with DISTILLERInsert offset folio 53 here 31105.053
63 


KING-6430 with DISTILLERInsert offset folio 54 here 31105.054
64 


KING-6430 with DISTILLERInsert offset folio 55 here 31105.055
65 


KING-6430 with DISTILLERInsert offset folio 56 here 31105.056
66 

Mr. HURD. Thank you. 

And, Ms. Manfra, you are now recognized for 5 minutes for your 

opening remarks. 

STATEMENT OF THE HONORABLE JEANETTE MANFRA 

Ms. MANFRA. Thank you. 

Chairman Hurd, Ranking Member Kelly, members of the committee, thank you for today’s opportunity to discuss the Department of Homeland Security’s efforts to secure Federal networks. 

I would like to begin my testimony by thanking Congress for its 

work on the Cybersecurity and Infrastructure Security Agency Act 

of 2017. If enacted, this legislation will streamline the National 

Protection and Programs Directorate, or NPPD, and rename our organization to more clearly reflect our central role in government 

and private-sector critical infrastructure security. Much progress 

has been made, but we must stay focused until this work is complete. The Department strongly supports this effort and encourages 

swift action by Congress. 

Cyber threats remain one of the most significant strategic risks 

for the United States, threatening our national security, economic 

prosperity, and public health and safety. Over the past year, Federal network defenders saw the threat landscape grow more crowded, active, and dangerous. While in many cases our defenses have 

been successful in mitigating these threats, we must do more to ensure our cyber defenses keep pace of technological change and 

evolving risk. 

In my role at DHS, I head the Office of Cybersecurity and Communications. A core part of my role is protecting and managing the 

overall information security of Federal civilian networks. To do 

this, we must first gain visibility to understand the exposure that 

the Federal enterprise faces. Then we need to use our authorities 

to reduce this risk, whether that’s through directives, guidance, or 

direct support to agencies. And, finally, we must build capacity 

within agencies to implement our guidance, act on threat information, and fully leverage the capabilities and services that DHS has 

to offer. 

Programs like the National Cybersecurity Protection System, or 

EINSTEIN, and the Continuous Diagnostics and Mitigation Program directly serve and enable these three lines of effort. 

Last year, the President signed an executive order on strengthening the cybersecurity of Federal networks and critical infrastructure, which set in motion a series of assessments and deliverables 

to improve our defenses and lower our risk to cyber threats. 

Across the Federal Government, agencies have been implementing the NIST Cybersecurity Framework. Agencies have been 

reporting to DHS and OMB on their cybersecurity risk mitigation 

and acceptance choices. DHS and OMB have evaluated the totality 

of these agencies’ reports in order to comprehensively assess the 

Federal Government’s cybersecurity risk management posture. 

The assessment found the Federal enterprise to be at risk. The 

choices we make to reduce this risk, in both cybersecurity budget 

and operational priorities, must be informed by a data-driven, riskbased assessment of Federal cybersecurity and the threat environment. 


KING-6430 with DISTILLER
67 

As part of the executive order, my office has been working with 

OMB, GSA, and Federal agencies to modernize the Federal Government’s IT infrastructure. We are exploring opportunities to consolidate network architectures, embrace shared IT services, all the 

while emphasizing cybersecurity as a foundational element to all 

new IT services. 

We recognize that legacy IT systems present considerable challenges in efforts to secure Federal networks. The risks posed by 

these antiquated, end-of-life systems has perhaps best been demonstrated by the difficulties agencies face in complying with DHS’s 

binding operational directives which govern vulnerability patching. 

Some legacy systems can no longer be patched, others are not supported by vendors, and some experience significant performance 

issues if not reconfigured during the security upgrade process. 

While in most cases DHS and the agencies have been able to address these issues and either upgrade, transition, or mitigate the 

problem entirely, this complicates and adds cost to agency efforts 

to patch their own systems—an exercise that does need to be as 

painless as possible. 

While the use of more modern IT has efficiencies and convenience of its own, the benefits it brings to cybersecurity efforts are 

also significant. 

My organization works with departments and agencies to identify and prioritize high-value assets or those systems for which a 

cyber incident could cause significant impact to the United States. 

We conduct security architecture reviews to assess network architectures and configurations and conduct in-depth vulnerability assets, which determine how an adversary could compromise these 

systems, persist in their networks, and gain access to sensitive 

data. 

These assessments provide system owners with recommendations 

to address identified vulnerabilities and assist them in prioritizing 

their limited resources to fix the worst things first. 

In closing, I want to assure this committee that DHS is embracing our statutory responsibility to administer the implementation 

of Federal agency cybersecurity policies and practices by leading 

the effort to secure the Federal enterprise, in coordination with my 

partners on the panel, following a risk-based approach. 

This committee played a key role in championing the passage of 

FISMA 2014 and clarifying these important authorities for DHS, 

and we thank you for those. 

The overarching goal of Federal cybersecurity is to ensure that 

every agency maintains an adequate level of cybersecurity commensurate with its own risk and with those of the Federal enterprise. 

Thank you for the opportunity to testify, and I look forward to 

any questions you may have. 

[Prepared statement of Ms. Manfra follows:] 


KING-6430 with DISTILLER
68 


KING-6430 with DISTILLERInsert offset folio 57 here 31105.057
69 


KING-6430 with DISTILLERInsert offset folio 58 here 31105.058
70 


KING-6430 with DISTILLERInsert offset folio 59 here 31105.059
71 


KING-6430 with DISTILLERInsert offset folio 60 here 31105.060
72 


KING-6430 with DISTILLERInsert offset folio 61 here 31105.061
73 


KING-6430 with DISTILLERInsert offset folio 62 here 31105.062
74 


KING-6430 with DISTILLERInsert offset folio 63 here 31105.063
75 


KING-6430 with DISTILLERInsert offset folio 64 here 31105.064
76 


KING-6430 with DISTILLERInsert offset folio 65 here 31105.065
77 

Mr. HURD. Thank you. 

And now it’s a pleasure to recognize the gentleman from Montana for 5 minutes. 

Mr. GIANFORTE. Thank you, Mr. Chairman. 

And thank you to the panel. 

Mr. Powner, it’s good to see you again. It seems like you’re here 

monthly. And I appreciate your help in moving forward the IT procurement. 

Mr. Zielinski, I would like to dive in a little bit into GSA’s role 

in procurement, particularly as it relates to shared services. Could 

you talk a little bit about, to help the committee, what are shared 

services and what do you see as the benefits of mandating those 

for agencies where appropriate? 

Mr. ZIELINSKI. So, in the broadest sense, shared services is an 

opportunity for us to, rather than having each agency independently build out a capability set, to be able to build those out in a 

centralized way. 

It could be that it is a government-operated, government-built 

shared service, or it could be that it is a commercially offered solution. In working with the Office of Management and Budget, as 

well as with our own Unified Shared Services Management office, 

we are working to develop a series of shared services along the 

lines of business. 

There’s a lot of opportunities and benefits to this approach. First 

of all, there’s significant cost savings. Secondly, as we talked about, 

the security posture, that ability for us to protect the shared service and be able to make changes to that individual or that one 

shared service and have all of the participants benefit across the 

government is significant. 

Mr. GIANFORTE. Okay. And what IT services are already being 

procured under a shared services model? 

Mr. ZIELINSKI. Oh, sir, there are a number. What I would like 

to offer is to be able to bring the full list, but I’ll give you some 

examples here today. 

Mr. GIANFORTE. Please. 

Mr. ZIELINSKI. For one, we have a shared service offering that’s 

in and around the implementation or the issuance of the PIV credentials, the HSPD–12 PIV credentials. That is operated out of 

GSA. There are 110 customer agencies with more than 750,000 credentials under active management. 

That’s an example of a very mature shared service that is utilized across government. There’s shared infrastructure for agencies 

to be able to go to, common issuance sites. In addition, there are 

shared services for payroll, shared services for financial services. 

And we continue to build out other shared services. 

And, again, I will bring back a more complete list of what those 

shared service offerings are. 

Mr. GIANFORTE. Okay. So it sounds like shared services allow us 

to standardize procurement in such a way that various agencies 

don’t have to roll their own, so to speak? 

Mr. ZIELINSKI. Correct. 

Mr. GIANFORTE. Yeah. 


KING-6430 with DISTILLER
78 

So there’s cost savings. You mentioned earlier $50 billion of annual procurement. If shared services were fully implemented where 

appropriate, how big is the size of the prize in terms of savings? 

Mr. ZIELINSKI. Yeah, I don’t have an answer for that. You know, 

I think that as we are now going through the different lines of 

business and identifying those opportunities for shared services, 

we’ll have a much better or more complete picture of what those 

savings opportunities are. 

Mr. GIANFORTE. In instances where you have used shared services, how much savings resulted? 

Mr. ZIELINSKI. It differs based upon the service itself. And, again, 

what I can do is bring back some more explicit information for each 

of these shared services as to where that is. 

Mr. GIANFORTE. Okay. 

So cost savings are one benefit. What impact does it have on security when a service is shared versus implemented individually by 

the agencies? 

Mr. ZIELINSKI. So I would like to start, and I would also like to 

ask my partner, Ms. Manfra, to also add in as well. 

One of the things that we’re able to do is that, as each individual 

agency is building out a capability, that means that those individual agencies are also responsible for ensuring that they are 

patching and kind of doing the basic blocking and tackling that’s 

necessary to secure the capability, and that if there is something 

that happens within the overall system that they have to respond 

to, that also means that they each individually would have to do 

that. 

In a shared services instantiation, we have where there is a central group who is managing that security posture of the shared 

service. And that means that, when there is something that occurs 

or there is a need for us to make a change or to address a vulnerability, we are able to do that once and it is addressed for all of 

the customers of that. 

Mr. GIANFORTE. And, again, I want to go back to my prior question. I realize you want to go collect more data, and I do want an 

accurate answer. But it seems like shared services presents an opportunity to standardize procurement, limit variability, increase security, and lower cost, all of which are good objectives. 

Where is shared services on your priority list as you’re working 

with agencies on procurement? 

Mr. ZIELINSKI. So I will say that, going back to the IT modernization report, this is one of the core principles within the President’s 

IT modernization report, is for us to look for those opportunities to 

build out shared services to be able to both speed the modernization but also to increase the protection. So it is one of the core priorities in moving forward with modernization. 

Mr. GIANFORTE. And final question: Who should be managing 

these shared services within the government? 

Mr. ZIELINSKI. The plan, as it stands today, is to look for managing partners based upon the capability areas. So, dependent 

upon what the business function or area is, that there is a role for 

the appropriate agency. So, in the case of HR shared services, OPM 

would have a significant role, as an example. 


KING-6430 with DISTILLER
79 

Mr. GIANFORTE. So, then, they could be a service provider to 

other agencies, if necessary? 

Mr. ZIELINSKI. Correct. 

Mr. GIANFORTE. Okay. Thank you. 

I yield back, Mr. Chairman. 

Mr. HURD. Ranking Member Kelly. 

Ms. KELLY. Thank you. 

The growing rate of sophisticated data breaches and cyber attacks in the private and public sector have heightened concerns 

over the security and strength of Federal IT systems. 

And some of these devastating attacks succeed because Federal 

systems are dangerously outdated and obsolete. And I mentioned 

in my opening statement that nearly 75 percent of the Federal 

Government’s IT budget is dedicated toward maintaining legacy 

computer systems. 

Mr. Powner, why does it take such a large share to maintain 

those systems? 

Mr. POWNER. Well, I think, historically, operational systems in 

the Federal Government get a pass. So when you look at that’s 

something the lights are on and it’s running and we’re serving the 

mission, we might not be serving the mission efficiently, we might 

not be serving the mission securely, but it’s gotten a pass over the 

years. That’s been the biggest problem. 

I think this committee, you know, going back to 2016, when we 

did the big report with the 8-inch floppy disk at DOD, helped raise 

the issue of how old and insecure and costly these systems are. 

We are starting to make progress. The problem is that we still 

need firm dates to replace these systems where we actually turn 

them off. I mean, I agree with all the comments, that it’s difficult 

to maintain and patch, there’s unsupported software. But, ultimately, the security solution is turning them off and decommissioning them. 

Ms. KELLY. I’m not trying to be comical, but because the systems 

are so old, do we even have the staff—we talk about the staff for 

the new systems and the workforce, but what about the staff to 

maintain these systems? 

Mr. POWNER. Well, that—so it’s very difficult. I know, personally, 

I do a lot of detailed work at IRS, and when you start looking at 

assembly programmers there, we’re losing them left and right. We 

pay a premium to contractors to maintain. We pay other younger 

programmers who know modern language as a retention. It costs 

money to maintain these systems. And each year we go on, it costs 

more and more, and we become more and more insecure. 

Ms. KELLY. And what happens if we just turn it off? 

Mr. POWNER. Well, right now, we need a lot of these mission-critical systems to actually do the mission. You know, the IMF system 

at IRS, that’s where we get $3.3 trillion in revenue through tax returns. It’s critical. 

Ms. KELLY. Uh-huh. 

Mr. POWNER. Chairman Hurd’s held hearings on the VA VistA 

system. I mean, we still need that to apply medical services to our 

veterans. 

But, again, you know, that’s why we need to keep them running, 

because they’re mission-critical. 


KING-6430 with DISTILLER
80 

Ms. KELLY. Okay. Thank you. 

The Modernizing Government Technology Act is a key component 

of this administration’s continued effort to improve Federal technology by providing financial resources and technical expertise to 

agencies. 

Does the MGT Act continue to be, you think, a priority for the 

Trump administration and OMB? 

Ms. WEICHERT. Absolutely. The MGT Act and the Technology 

Modernization Fund are absolutely priorities for the administration. 

And we’ve actually pulled together in the President’s Management Agenda, which will be released next week and was hinted at 

in the President’s budget in February, a wholistic perspective on 

how we tackle these issues, which is not purely the technology 

piece, as you have mentioned. It includes issues around data and 

data structure. It also includes very critical people issues. 

We want to solve these issues wholistically, build on past successes, and we believe that the MGT and the Technology Modernization Fund will be great stepping stones toward the future of 

really pulling all of these dimensions together so that they are not 

siloed by function, where, you know, we have CIOs, you know, who, 

by the way, need more authority—and you all have done great 

work in FITARA to do that, and we support that. But we also need 

the human capital element, the financial element, the procurement 

element to be at the same table. 

And so what we’re laying out in the President’s Management 

Agenda is that wholistic framework. It was why I was so eager to 

actually be here and share. Because one of the root-cause observations that we had when we looked at how government was tackling 

these issues versus the private sector, it was that lack of integration across function. And we plan to tackle that, leveraging these 

authorities that Congress has provided through the MGT Act and 

TMF. 

And, by the way, we really hope the appropriators actually fund 

the TMF. 

Ms. KELLY. Okay. Thank you. 

Mr. Powner, can you comment on the steps that OMB is taking? 

Mr. POWNER. Well, I think, clearly, the guidance that OMB just 

put out, you know, that’s the right direction. And that guidance 

was very solid. You know, now the hard part is implementation. 

You know, we’re really good at plans and guidance in this town, 

but we’re not always good at getting things done and implementing 

them completely. 

So let’s do this right with the MGT Act, because we got savings 

out there. As Mr. Zielinski said, with shared services or still with 

some data centers, we can populate these working capital funds 

and really do MGT right. 

Ms. KELLY. Thank you. 

And I yield back. 

Mr. HURD. Mr. Blum, you’re now recognized for 5 minutes. 

Mr. BLUM. Thank you, Chairman Hurd. 

Thank you to our panelists for being here today. 

Mr. Powner, your challenge is, in the next 5 minutes, to make 

me an expert on cloud computing. Cloud computing has been in the 


KING-6430 with DISTILLER
81 

news lately with the Federal Government. Department of Defense, 

I think, is looking at going to cloud computing. I assume the entire 

government will be there at some point. 

Can you talk to me about the efforts to go to cloud computing, 

A? B, financially, is that going to save the taxpayers money or not? 

And, C, I’m particularly interested in the following, and that is, 

will it be more secure or less secure or perhaps the same level of 

security that we have today, not being in the cloud? 

Mr. POWNER. So there’s all kinds of various aspects of the cloud. 

So, like, for instance, on our data center situation we have, when 

I say that some agencies by 2020 should get out of the business of 

data centers, that’s because we have inefficient data centers that 

they’re not going to optimize, maybe two-thirds of them. And what 

we could do there is we could host our existing applications in a 

cloud environment or on servers and infrastructure maintained by 

contractors who are cloud providers. 

So that’s one way that we could actually save money and have 

optimized data centers, by actually outsourcing all of it to the 

cloud. 

We can also, too, in some of the shared service areas that we 

talked about, you can actually buy software as a service in the 

cloud from many of these cloud providers. And that’s another way 

where we can save money. 

However, there are some of these mission-critical applications 

like some of these homegrown systems that are critical to agencies’ 

mission that you’re not going to find that as a software, as a service, that we’ve got to actually just do the hard work and convert 

those old systems. 

So cloud, there’s a great opportunity. It’s not the solution for everything. But there’s substantial savings. 

And from a security perspective, you know, if you really look, the 

intel community kind of led the cloud migration. We were concerned on the civilian side about having enough security. So if it 

was good enough for intel, it’s probably good enough for a lot of 

others. 

The other thing you could do is, through your contracting provisions—and we did work on this, looking at service-level agreements 

and contracts—you can specify the level of security you want from 

those cloud providers and actually dictate the level of security. So, 

in many ways, cloud services can be more secure than what we currently have. 

Mr. BLUM. Do you think all Federal IT should eventually end up 

in the cloud? 

Mr. POWNER. There are some aspects that won’t be in the cloud 

because they’re unique to agency missions, but there’s a large portion that could end up being in the cloud. 

But there are these pockets of unique applications that we do 

that no one else has that we have to do the hard work and convert 

those to more modern platforms and modern software. 

Mr. BLUM. Where are we at today in this journey to the cloud? 

Mr. POWNER. So that’s a good question. We’re doing some work 

for this committee where we’ve done prior works, and we try to 

measure it as a percentage of budget or IT spend, and it’s very difficult. You know, we did this work a couple years ago, where agenVerDate Nov 24 2008 10:37 Sep 04, 2018 Jkt 000000 PO 00000 Frm 00087 Fmt 6633 Sfmt 6633 H:\31105.TXT APRIL

KING-6430 with DISTILLER
82 

cies varied from 2 to 7 percent of their IT budgets were in the 

cloud. That’s improved somewhat. But it’s very difficult to give you 

a good, hard number right now. We’re working on that for this 

committee. 

Mr. BLUM. Thank you. 

Ms. Weichert, is it? 

Ms. WEICHERT. Yes. 

Mr. BLUM. OMB, how involved are they in this migration to the 

cloud? 

Ms. WEICHERT. So it’s a great question, and it is actually one of 

the priorities that we’re laying out as part of the President’s Management Agenda. Now that the Federal CIO is in place, it is on her 

top priority list. 

And we’re working closely with GSA and the centers of excellence 

on the implementation. They’ve already met to put together tiger 

teams in terms of cloud email adoption, and they’re looking at 

other areas where commercially available solutions are already in 

place, secure, and working at some agencies, to elevate the lessons 

from those and extend them across government. 

But ultimately the test, to the question that you asked earlier 

around which things should migrate to the cloud, it’s essentially 

going to be dependent on the mission; the service aspects, so how 

well we can serve the needs of our citizens and the American people; and then the stewardship aspects of financial stewardship. So 

we’re really going to be looking at balancing those three items. 

Mr. BLUM. Thank you. 

Mr. Zielinski—I hope I pronounced that right—this is kind of interesting. The centers of excellence, can you just briefly tell me 

about that and that effort? 

Mr. ZIELINSKI. Certainly. Thank you for the question. 

Going back to some of the things that Mr. Powner mentioned, as 

agencies are making these decisions about their strategies for moving to the cloud or considering the cloud, the centers of excellence 

are places where we bring together technical expertise, the engineers and others who understand the dynamics of matching those 

business applications and those business functions to where they 

best lend themselves to a cloud application, whether that software 

is a service or platform is a service, and then help agencies to find 

acquisition strategies for them to be able to move. 

So there’s a lot of direct assistance that those centers of excellence provide to a customer agency, and they do that through 

bringing together the expertise, as Ms. Weichert said, being able to 

make sure that we have all of those functions working hand in 

glove, the technical expertise as well as the acquisition. 

Mr. BLUM. Is it more of a planning function or more of an execution function, the centers of excellence? 

Mr. ZIELINSKI. It’s absolutely an execution function, sir. 

Mr. BLUM. Because I agree with what Mr. Powner said earlier 

about we’re good at planning, not so good at following through. 

Thank you very much. I am out of time and I yield back. 

Mr. HURD. I now recognize the ranking member. 

Ms. KELLY. I just have one quick question and not for Mr. 

Powner. 

How long have all of you been in your positions you’re in now? 


KING-6430 with DISTILLER
83 

Ms. MANFRA. I was appointed in June of last year, ma’am. 

Mr. ZIELINSKI. I’ve been with GSA for 2 years. 

Ms. KELLY. In the position you’re in now? 

Mr. ZIELINSKI. Six months. 

Ms. WEICHERT. The Senate confirmed me on Valentine’s Day of 

this year. 

Ms. KELLY. All relative newbies, okay. No insult to you, I just 

knew you’d been around. Thank you. 

Mr. HURD. He’s been there forever, I think is the right answer. 

Mr. Zielinski, can we follow up on the centers of excellence. I recognize myself for 5 minutes. How does this program differ from 

18F? 

Mr. ZIELINSKI. So thank you for the question, sir. The 18F has 

those technical experts that the centers of excellence can actually 

tap into. So as I talked about bringing together the different discipline areas to be able to bring to bear on a particular agency 

problem set and to assist them in being able to understand the dynamics of their business case and how they can move forward, 18F, 

as an organization, would be one of the areas into which the centers of excellence can reach to bring that technical expertise to the 

table. 

Mr. HURD. Got you. And how do we ensure these centers of excellence, other than having GAO white glove it, how do we ensure 

that these don’t duplicate efforts that are going on in the rest of 

the government? 

Mr. ZIELINSKI. So going back to the agenda that has been laid 

out by the administration in and around starting with the IT modernization report as well as with the President’s Management 

Agenda, it’s a very tight weave in terms of ensuring that there’s 

a collaboration across all those functional areas. 

And there are many opportunities for those functional areas to 

be brought together to ensure that we are all bringing to bear the 

best talent and that we’re also not duplicating effort, sir. 

Mr. HURD. Good copy. 

Ms. Weichert, one of the things that is still frustrating, and I’m 

glad Mr. Powner alluded to this in the beginning of his remarks, 

is CIO authorities. We can’t hold CIOs accountable if we don’t give 

them all the power they need. FITARA gives them that authority, 

but in many places the agency CIO doesn’t have the complete 

budget authority of those—of that entire operation. 

And Transportation is an example. I think they have nine CIOs, 

people with the title, nine CIOs, $3 billion-plus budget. 

Can we reprogram the funds from those various sub-CIOs into— 

under the Federal—under the agency CIO in order to streamline 

that budget authority? 

Ms. WEICHERT. So not being an expert on appropriations, I want 

to caveat and say that I would love to answer that in more detail 

after conferring with some of our budget folks. But what I can say 

is absolutely agree with your frustration. It’s something we in the 

administration share and are looking very closely at how do we address. 

I think in the President’s Management Agenda we are laying out 

how all of the components of the various authorities across government, how they work together and how they align together, and to 


KING-6430 with DISTILLER
84 

avoid duplication, while giving the maximum elevated level of capability to the CIOs. 

I think the Technology Modernization Fund and the MGT, in 

providing new capabilities around working capital funds, that is a 

place we are going to start and are already exploring ways that we 

can work with agencies to help them focus and target resources towards the highest priority projects, as Mr. Powner has suggested. 

In terms of getting additional capabilities, I think the authorities 

are different in terms of transfer and how they can use their working capital funds, that I wouldn’t want to give you an across-theboard answer. 

Mr. HURD. But would you have heartburn if we were to reprogram some of these to ensure that the agency CIO had all the 

budget authority for IT spend across that network? 

Ms. WEICHERT. So I haven’t studied that specific issue. 

Mr. HURD. Okay. That’s a fair answer. 

Ms. WEICHERT. But what I can say is we are absolutely in alignment in terms of the idea that the CIO for the broad agency needs 

to have all the capabilities and tools to make these very profound 

investments. 

And the more we can align to the way the private sector works, 

where you’ve got a general manager of a division or an agency, and 

their C-suite includes the chief information officer, the chief financial officer, the chief people officer, and, where appropriate, the procurement officer, they need to all be there in lockstep. 

Mr. HURD. And the CIO. I think you said that. 

Ms. WEICHERT. I said that first, yes. 

Mr. HURD. Okay, first. Okay. Gotcha. Gotcha. I agree. And my 

teams would get mad because we’re talking about how do we 

change the FITARA Scorecard to penalize agencies that don’t have 

the Federal CIO reporting directly to the agency or deputy agency 

head. 

We’ve asked everybody why, what’s going on, why is that the 

case? We’ve gotten a lot of excuses: ‘‘Oh, it’s kind of already there.’’ 

Well, if it’s already there, then change the damn structure. And so 

we are looking at having that be reflected in the FITARA Scorecard. 

Mr. Powner, do you have any opinions on the reprogramming 

and giving complete budget authority to the CIA—CIO? Let me rephrase that. The CIO, not the CIA. I don’t want anybody to get 

mad and run an ad against me. 

Mr. POWNER. I think the first step is that we understand all the 

IT spend. I think many CIOs, we don’t even know the full totality 

of what we spend at these departments and agencies. So once we 

understand that, I do think the CIOs should control that more. 

It’s okay, too, if there ARE some business units that control it 

and they act in partnership, where the CIO is working with those 

business units to spend it appropriately, to oversee it the right way 

and that. 

So I think there’s probably even some blend. I think right now 

if we did it completely whole hog, you have complete budget authority, the whole bit, I don’t know if that would—maybe we need 

to shock the system as you’re intending. That’s one way to do it. 

Mr. HURD. Your word, not mine, sir. 


KING-6430 with DISTILLER
85 

Mr. POWNER. But the other way to do it is to have some type of 

blend where we know the entire spend and the CIO has a role, 

whether they control every dollar or not, but they’re still responsible for governing over it. We’ve got too much IT spend that we 

don’t have IT people on it. 

Mr. HURD. You reminded me of something I was going to ask. 

And, Ms. Weichert, this may not be something on the top of your 

mind. 

Or, Mr. Zielinski, I think this is outside of your scope. 

The Department of Defense recently made the decision to not 

publish their IT amount. I believe it was in a recent—was it an 

OMB report? What was it? The analytical prospectus. It said: Hey, 

we’re going to stop showing DOD’s number on IT along with everyone else. 

So we went from spending, the Federal Government spending $90 billion to $40 billion, and they said, you know, asterisks, fiscal 

year 2018, it was roughly $50 billion. 

Do you have any insight into that decision, that process? And we 

will be bringing—again, not to, you know, show our hand—but 

we’ll be bringing DOD for the next FITARA Scorecard hearing to 

have them answer that directly. But I’d welcome your thoughts. 

Ms. WEICHERT. Yeah. Unfortunately, that was prior to my being 

confirmed, so I wasn’t read in on that particular decision. 

Mr. HURD. When you’re talking to them—— 

Ms. WEICHERT. I will note it. 

Mr. HURD. —tell them this committee is interested. 

Ms. WEICHERT. I will share that. 

Mr. HURD. And I’d love to have the answer prior to—should I introduce these into the record? 

So, yeah. The analysis in this chapter excludes the Department 

of Defense and classified spending, which in fiscal year 2008 was 

$42.5 billion, or 44 percent of the IT budget. So we’re going to start 

showing only 66 percent of the budget as a whole number, which 

seems a little odd to me. 

Ms. Manfra, one of the things I want to do with the FITARA 

Scorecard is transition it into more of a digital hygiene scorecard 

as well. I think the elements, as Mr. Powner has talked about, 

we’ve got to continue to double down on those issues. 

But I think being able to highlight at the macro level good digital 

hygiene is important. I think the inclusion of the MEGABYTE Act 

on that was one of that. Do you know all the software that’s running on your system? And I think only three were able to answer 

yes, which is pretty shocking. And, again, these are self-reporting 

numbers. 

So what are some of the areas that you think that we should or 

could be exploring when it comes to digital hygiene and how we 

look across that over the entire enterprise? 

Ms. MANFRA. So I think, first of all, I think that’s a great idea, 

to include that. Frankly, shining a light on some of these basic 

practices has been useful in agencies prioritizing. 

So I briefly alluded to the critical vulnerability patching. What 

we saw through years of assessments was just continued poor 

patch management programs. Some of it does have to do with legacy systems and all that. 


KING-6430 with DISTILLER
86 

But what we decided to issue, our first binding operational directive, was actually to require the time to patch a critical vulnerability down to 30 days. 

And the important way, though, that we were able to be successful, I think, with this and with other directives and other guidance 

that we provide is that we can independently validate. We’re not 

relying on self-reporting. And so the more capability that DHS is 

deploying—in this case it’s the external scanning that we’re doing 

of all internet-facing devices—that we can say, no, I can see that 

you haven’t actually patched. 

The good news story is that when we—I think fiscal year 2014 

average time to patch was somewhere in excess of 200 days for critical vulnerabilities, which is bad. After the directive—and it continues, which shows how these things change behavior—we’re averaging in the 10 to 15 days. 

And so it’s helping them prioritize their very limited resources by 

focusing on known issues, and that’s what we want to continue to 

do, but it’s also important that we can independently validate this. 

You talked about knowing what software on your system. So the 

Continuous Diagnostics and Mitigation Program that we’ve been 

deploying, the first phase is hardware and software asset management. And we’ve learned a lot through that program in what agencies thought they had on their network was not exactly what we 

found that they had on their network after deploying these. 

And I know in one sense it’s frustrating to sort of be in that environment, but at least we’re in a position now where we do know. 

We know what’s connected to the network and as we deploy more 

tools. 

And as a side note, this program actually is also very cost-effective, and we’ve been able to identify that I think it’s 75 percent cost 

savings off of schedule—if they had bought these on Schedule 70. 

So we’re deploying common tools that are identifying what and 

who is on networks. And I believe that this will fundamentally 

transform the way that we do, in the first case, vulnerability management for the government, but eventually we will get to event 

management and ongoing authorization in those programs. 

But it has to be through the deployment of these standardized 

tools that then feed data back to an agency CIO and DHS so that 

we can, through automated sensors, understand where they are. 

Mr. HURD. Would you have security concerns of publishing that 

number of how long it takes to patch software, like the average it 

takes to patch software from agency from agency? 

Ms. MANFRA. I don’t know how—— 

Mr. HURD. You can take time to think about it. 

Ms. MANFRA. Yeah. 

Mr. HURD. It’s just I think that’s an element that, self-reporting, 

we can establish a letter grade based on what are industry best 

practices. Is a week an A? Two hundred days is definitely an F, 

right? Where that’s something that we could package and keep 

track of and make sure that we’re continuing to shine a light on. 

Ms. MANFRA. Absolutely, sir. And there’s a few other things that 

we’ve identified as very common practices that we’re focusing our 

guidance on. And we’d be happy to work with you on how we can 

improve those practices. 


KING-6430 with DISTILLER
87 

Mr. HURD. And before we get to the gentleman from the Commonwealth of Virginia, my last question is, one of the things that 

I’ve—in the 3–1/2 years we’ve been doing this together, we’ve asked 

a lot of questions about, are you doing technical vulnerability assessment, penetration testing? And a lot of agencies have said yes, 

and then you find out after the fact they’re just doing a scan, that 

they’re not bringing a third-party system, a third-party vendor to 

come in and do that testing. 

Your organization has been doing that. Have you seen an increase in that as a best practice? 

Ms. MANFRA. So you’re right, there isn’t a very common definition of what people mean by penetration testing. You know, as I 

noted, we do passive scanning, but that is to identify one set of 

issues. 

We also do our risk and vulnerability assessments, which is penetration testing, which is actively going and trying to identify and 

exploit vulnerabilities. That’s what we would consider. 

We haven’t previously taken statistics on what agencies are 

using penetration testing. I can tell you that just in the last fiscal 

year, we did 42. We focus, prioritize high-value assets. So we go 

through all of the high-value assets to do a full risk and vulnerability assessment, which includes a penetration test as well as a 

report to them. But we could definitely follow up on that. 

Mr. HURD. Well, we’ll be asking the agencies this question, so 

when we collect that information we’ll share it with you so that 

you’re aware. 

Ms. MANFRA. Thank you, sir. 

Mr. HURD. Now I’d like to recognize the gentleman from the 

Commonwealth of Virginia, the ranking member, Mr. Connolly. 

Mr. CONNOLLY. I thank my friend. 

And welcome to our panel. 

And thank you both to Mr. Hurd and Ms. Kelly for their leadership of this subcommittee and on this subject matter. We’re really 

fortunate to have Members who care about the subject matter and 

delve into it. It’s actually rare. You’d think more Members would 

be involved in IT, but they actually aren’t, for various and sundry 

reasons. 

And so one of the great pleasures of serving on this committee 

is that—and Mr. Meadows is not here, but the four of us have really worked seamlessly, in a nonpartisan way, to try to help rationalize Federal IT policy. And I think for all four of us, it doesn’t 

matter whether it’s a Democrat or a Republican administration, we 

want it to work. 

And so, in that spirit, welcome. 

Ms. Weichert, in March of last year the White House announced 

the Office of American Innovation. And after that, OAI was credited with a whole bunch of projects as large as pushing the overhaul at the Veterans Administration healthcare IT system, setting 

the policy for the Federal Government’s adoption of AI, and presumably implementation of FITARA, data center consolidation, 

moving to the cloud, empowerment of CIOs, and so forth. 

Now, under the E–Government Act of 2002, normally that role 

would be played by the Federal CIO. Now that presumably we’re 


KING-6430 with DISTILLER
88 

going to have a Federal CIO, what is OAI’s role going forward, and 

how does OMB play a role in all of this as well? 

Ms. WEICHERT. I think it’s a great question, and we are working 

in lockstep across the administration to set out a focused agenda 

for all the elements around not only IT modernization, but the 

other enabling capabilities around data transparency and accountability, as well as the people dimensions of that. 

And OAI did a great job providing catalytic capabilities in getting 

a lot of these activities started. But what’s been included in the 

President’s budget in February and what will be rolled out next 

week in the President’s Management Agenda is the comprehensive 

go-forward plan. 

We do have a Federal CIO, an outstanding leader from the private sector who has done execution of change in complex, highly 

regulated environments in the financial services and other industries, who’s really here to help continue to carry that torch. 

I think a lot of the activities that have been enabled by the MGT 

Act and the TMF are stood up. The Federal CIO actually met earlier this week with the members of the IT Modernization Fund 

Board, and they did a dry run, so that when appropriations come— 

I’m hoping they’re coming soon—that the board will be prepared to 

act quickly. 

We continue to work very closely with OAI in terms of helping 

shape the strategy and bring to bear the best thinking of the administration and also marshal resources outside of government to 

provide insights that might be helpful in our journey. 

But we in OMB are really leading the direction with the President’s Management Agenda and bringing the executive branch 

along. And I look forward to having you all get to see what we’re 

putting together that’s going to be in the PMA launch next week. 

Mr. CONNOLLY. So I know that the chairman talked about maybe 

broadening the current FITARA Scorecard at some point to a digital hygiene scorecard. I would be supportive of that once we make 

more substantial progress on implementation of what’s in front of 

us, because we’ve seen some backsliding. You know, DOD, the Big 

Kahuna, got an F. And so we want to see more progress, but we 

can’t really see it without leadership coming from your office. 

I assume, but let me ask, you are committed to the metrics set 

in the law, FITARA, and the tools, allowing us to try to facilitate 

that, that MGT, just passed into law, also gives agencies, to facilitate implementation of the law. 

I assume you’re trying to push agencies to meet the metrics set 

for them in the law. 

Ms. WEICHERT. Absolutely. And I think the focus historically, 

that has been very siloed. In a lot of cases some of the challenges 

around FITARA implementation and some of the things measured 

in the scorecard hit root cause issues that were underlying those 

things. In a lot of cases, people issues are part of the problem. 

Mr. CONNOLLY. Yes. 

Ms. WEICHERT. In some cases data and even the ability to see 

the problem is part of it. 

So part of what we want to do is actually use the broad management table to really shine a light on those issues. And to the extent 

the scorecard needs to evolve or mature, we’d be very happy to take 


KING-6430 with DISTILLER
89 

input from GAO and work with Congress on that. But we are very 

supportive of the spirit of FITARA and moving forward with that. 

And I guess the last thing I’ll just say is, my perspective in the 

private sector, if you’ve got a broad failing to meet the needs outlined in a strategic plan or a set of metrics, it’s incumbent upon 

the person who’s accountable for those, especially if it’s me, to really understand are there root cause issues that are preventing us 

from doing that and then addressing those as well. 

Mr. CONNOLLY. Yes, I couldn’t agree with you more. And like 

you, I come from the private sector. I spent 20 years as a corporate 

officer. And what I learned in the private sector and the public sector is, if the boss doesn’t care, neither do I. 

Ms. WEICHERT. Right. 

Mr. CONNOLLY. I’ll give it lip service. 

Ms. WEICHERT. I care. I care a lot. 

Mr. CONNOLLY. Exactly. 

But they need to feel pressure. They need to know I’m going to 

be evaluated by the boss on implementation, on meeting those 

metrics. 

And the other thing, and then I’ll be quiet, but with respect to 

personnel, we’ve got to empower, in Latin we call it primus inter 

pares, the first among equals in CIOs. There has to be a primus 

CIO who’s got the responsibility, the accountability, and the power 

to make decisions. They’ve got to be empowered, and everyone has 

to know that. 

If the CIO of an agency is reporting to the deputy assistant 

Gromit in the basement, that does not escape the attention of everybody else. And I might give lip service, but I know he or she 

doesn’t really have the boss’ attention. 

We elevate the issue—I mean, we elevate the role of that person 

and the stature of that person, we elevate the issue and its importance in everybody’s eyes. 

I commend that to you as a reform. It doesn’t cost a lot of money, 

but I think it would have a profound effect on performance and 

would save a lot of money for agencies over time and make us a 

lot more effective. 

Thank you, Mr. Chairman. 

Mr. HURD. Thank you, sir. 

And I failed to spend some time on MGT, so I have a few questions. And, Ms. Weichert, they’re probably best for you. 

The agencies are still planning to present their implementation 

plans of the MGT working capital fund on the 27th of March. Is 

that correct? 

Ms. WEICHERT. That is correct. 

Mr. HURD. And will you be able to share those with us? 

Ms. WEICHERT. So we will be able to share the status on the 

working capital funds early this summer. So we are actively working with the agencies to understand what specifically their needs 

are in terms of implementing on that. 

So we already have a number that are well on the way of implementing it. We have identified some challenges related to transfer 

authorities that we need to work out. And we’ll actually be coming 

back to Congress with some thoughts about ways to streamline 


KING-6430 with DISTILLER
90 

what’s needed to actually make it work as intended in the legislation. But we will be coming back imminently. 

Mr. HURD. The sooner you come to us on that, we’ll do everything we can to help, because I think it’s important by the end of 

this fiscal year to have some money deposited in those funds at a 

handful of agencies to be sure that it’s working. 

Ms. WEICHERT. We absolutely agree, yes. 

Mr. HURD. Mr. Powner, do you think we can do that? 

Mr. POWNER. Definitely, definitely. And we’ll continue to work 

with you. I know that’s one of the things we want to focus on the 

scorecard, too, as we evolve that, to look at the establishment of 

those MGT funds and the accountability, who’s in charge of those 

and that type of thing. 

Mr. HURD. Because if you are able to deposit money in your MGT 

working capital fund, it shows a culture of modernization, and I 

think that’s important to monitor and focus on. 

I’d like to thank our witnesses again for being here today. The 

hearing record will remain open for 2 weeks for any member to 

submit a written opening statement or questions for the record. 

If there’s no further business, without objection, the subcommittees stand adjourned. 

[Whereupon, at 4:26 p.m., the subcommittees were adjourned.] 


KING-6430 with DISTILLER
(91) 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD


KING-6430 with DISTILLER
92 


KING-6430 with DISTILLERInsert offset folio 66 here 31105.066
93 


KING-6430 with DISTILLERInsert offset folio 67 here 31105.067
94 


KING-6430 with DISTILLERInsert offset folio 68 here 31105.068
95 

Æ 


KING-6430 with DISTILLERInsert offset folio 69 here 31105.069