OMB preparing to open shop for IT security LOB

The Office of Management and Budget hopes to begin setting up several lines of business for IT security in the next fiscal year, with the selection of the first centers of excellence.The task force established to develop the new line of business expects that at least a dozen agencies will be named centers of excellence for various security functions, allowing them to market their expertise to other agencies, said task force member George Bonina, the Environmental Protection Agency’s chief information security officer (CISO).“If you are not a center of excellence for a particular function, you will have to be a customer of a center and your business case will have to reflect that in each of the areas,” Bonina said Tuesday at the Federal Information Assurance Conference being held at the University of Maryland.A line of business is a necessary business function that typically is outside of agencies’ primary missions, such as financial management or, in this case, cybersecurity. Rather than have each agency duplicate non-essential functions, OMB designates agencies that have shown expertise in these areas to provide them to other agencies on a fee-for-service basis.Improving performance in IT security is becoming more important. Despite a growing awareness of the need to improve security of the government’s information systems, federal spending on security has been static, at about $4.2 billion a year for the last three years, while total IT spending has been slowly growing, according to OMB estimates. In March, OMB set up a multi-agency task force with a goal of establishing a security line of business during the fiscal 2007 budget process. The task force has representatives from 34 agencies, most of them at the CISO level, Bonina said. The task force has recommended establishing a governance board that would oversee a line of business project office. The project office would set criteria and establish performance measures for those agencies designated centers of excellence. Multiple centers would be designated for each of four problem areas identified by the task force:Bonina said the task force hopes to have at least three centers of excellence for each of these problem areas, “so there will be competition to improve performance and drive costs down.”The centers of excellence will not replace existing IT security programs and resources, such as the U.S-Computer Emergency Readiness Team. It is expected that agencies applying to be centers of excellence would contract with private sector partners to help provide a full range of tools and services.Agencies can propose to become a center of excellence in the IT business case submitted with their 2007 budget requests. Those agencies not proposing to become centers of excellence in a given area will have to outline in the budget request their plans for transitioning those functions to a designated center when they open for business. The requirement for using the services of a center of excellence probably will be phased in over a two or three year period to allow for existing contract obligations and other commitments of agencies. Because this process is part of the budget process, it is shrouded in secrecy “until it becomes public in the president’s budget,” which is expected to be presented to Congress in February 2006, Bonina said.But Bonina did say that OMB hopes to select centers of excellence for the FISMA and training components late in fiscal 2006, with selections for situational awareness and incident response and lifecycle security solutions in 2008.