C&A Now Weightless at NASA

Neil Armstrong said it best when he touched the moon's surface for the first time: "One small step for man, one giant leap for mankind." Here we are over 40 years later, and NASA is setting the tone all over again--in cybersecurity.

Here's what we know: A May 18th memo from NASA's Deputy Chief Information Officer Jerry Davis repudiates certification and accreditation and advocates for continuous monitoring. The Obama administration appears to be on board, pushing the Office of Management and Budget last month to change its reporting requirements from compliance by paper to continuous reporting. Additionally, federal Chief Information Officer Vivek Kundra went on record encouraging agencies to make the transition.

NASA is the first agency since the State Department to issue a rebuke for business as usual even if it still remains law. It probably saved the space gurus $10 million. But let's be clear. Several agencies already had planned on crossing over to the new White House requirements, but not until near the end of the summer. Meanwhile, the longer they wait, the more money is lost.

The question now is: When will others follow? If NASA's announcement does anything, I think it puts the emphasis on other agencies to move quickly. We see examples of this throughout politics. One state sets forth a bold plan to take on a hot button issue, the issue picks up steam and another state pencils in the discussion. Federal agencies, in many respects, work like state governments, and sometimes all they need is a little encouragement and willpower from watching others. I suspect NASA's move will be a boon to other federal agencies. Perhaps when more agencies push back, Congress will have more than enough momentum to make the necessary amendments to FISMA.

Armstrong didn't know how right he was when he jumped from the last rung of the ladder. Small steps can be giant leaps, and NASA's announcement this week is no exception.