IGs rap agencies on infosec progress

PCIE/ECIE report

With three years down and just two to go, federal agencies aren't even close to meeting a presidential mandate to secure the information systems that support the nation's critical infrastructure.

That's the conclusion of a report compiled by inspectors general across government, who say agencies have their work cut out for them in meeting the May 2003 deadline imposed in Presidential Decision Directive 63, signed by President Clinton in 1998.

Efforts by the agencies to date are lackluster at best, according to the IGs. The individual agency IG "reports issued to date present findings that, collectively, question the federal government's ability to achieve full operating capability by May 22, 2003," said the report from the President's Council on Integrity and Efficiency and the Executive Council on Integrity and Efficiency.

The Bush administration is not legally bound by deadlines set in Clinton's directives, said John Tritak, director of the Critical Infrastructure Assurance Office. But he said President Bush understands the importance of protecting the country's critical systems, such as those that support the Commerce Department's National Hurricane Center and the Federal Aviation Administration's National Airspace System, as examples.

The IGs found that many agencies haven't finished their plans for securing the information systems, most have failed to identify their critical assets and almost none have completed their vulnerability assessments. The report was completed March 21 and sent to Richard Clarke, national coordinator for security, infrastructure protection and counter-terrorism at the National, security Council and to Mitchell Daniels Jr., director of the Office of Management and Budget.

The IGs cited several reasons for the lack of progress. They range from agencies believing they were exempt from the directive to a lack of coordination and leadership at the governmentwide level. They recommend that OMB "assign one organization" the power to oversee the entire government effort.

These conclusions confirmed what many lawmakers had suspected. Rep. James Green-----wood (R-Pa.), head of the House Energy and Commerce Committee's Oversight and Investigations Subcommittee, said at a recent hearing that "we are not surprised or pleased with what we are finding" on PDD-63.

The hearing followed an inquiry last month into infrastructure protection efforts at the 15 agencies and commissions the committee oversees. That probe revealed that few agencies have done the required penetration tests, and that even those were limited and did not really address the problem, Greenwood said.

The General Services Administration leads federal agencies' compliance with PDD-63 and has made several changes to its security offices since last year. That includes creating an Office of Information Assurance and Critical Infrastructure Protection to focus solely on policy issues, including PDD-63.

Sallie McDonald, assistant commissioner of the office, said, "I recognize that all agencies should be under PDD-63 ...and [we] have plans to expand our outreach programs to include all of the federal agencies."

Those expanded programs begin this month when representatives from each agency meet to discuss planning and implementation, to share best practices and to talk about their experiences. The plan is to hold the meetings quarterly. "By working together, hopefully we can meet the deadline," McDonald said.

Security experts at the hearing said growing support from Congress, along with last year's Government Information Security Reform Act, should raise agencies' awareness. The security law took effect last October and requires agencies to follow good security practices, including submitting the results of annual self-assessments to Congress.

OMB should step forward to provide guidance to help agencies gauge progress toward meeting the 2003 deadline, according to the IGs. "OMB has the ability to guide the conduct of agencies, so they need to be a key player," said Russell Rau, assistant inspector general for auditing at NASA, the lead agency for the report.

The IGs are now giving agencies time to implement their plans and will follow up with another review and new recommendations this fall, Rau said.