State Department IG highly critical of IT sub-bureau

When running a department, it is a good idea to have a mission statement, strategic planning and a workload that justifies its organizational structure and the millions of dollars of taxpayer money it receives each year.

The State Department's Bureau of Information Resource Management, Office of Information Assurance (IRM/IA) has none of those things, according to a State Department's Office of Inspector General audit released in July, and further lacks controls and procedures to monitor contracts, task orders and blanket purchase agreements totaling $79 million.

IRM/IA, established in 2003 to comply with the Title III of the E-Government Act, was formed to address information security requirements, yet OIG found the majority of those functions are performed in other State Department offices.

The audit criticized the bureau's certification and accreditation operations (C&A) because mishandling of these processes – as well as guidance and reviews of C&A packages – contributed to expired authorizations to operate (ATOs) for 52 of the State Department's 309 systems. Some delinquent systems have been operating on expired authorizations for more than two years, the audit states.

IRM/IA – with its staff of 22 full-time employees and 36 contract employees, and its $10 million operating budget – plays a lead role in overseeing the State Department's cyber-security program, including information assurance policies, standards and guidelines, and compliance with national security directives.

Yet its sister departments do most of the heavy lifting, the OIG report states, including management and oversight of the State Department's information systems, which include its classified and unclassified networks. Personnel in other IRM departments are responsible keeping watch against cyber-attacks and risk measures, as well as desktop security guidelines.

"IRM/IA performs a limited number of information assurance functions, does not have a lead role in most of the functions it does perform and, for the most part, only compiles information generated by others," the report states, before concluding the bureau's realignment request to create a fourth division was not justified.

"In light of the lack of active involvement in many of its stated responsibilities, the proposed IRM/IA office realignment for an additional deputy position and one more division, as well as the need for some of the current divisions, are not justified by the current level of work being performed," the audit states. Not surprisingly, the audit was critical of the bureau's head, Chief Information Security Officer William Lay, who accepted the position in September 2012. Lay, the report stated, did a good job on arrival rebuilding relationships internally and externally with IRM/IA, but he has not addressed critical management issues. He also isn't in the office much, according to OIG, so staff is often left wondering what to do.

"The CISO has not provided division chiefs with priorities based on defined goals, as a result, the staff is not proactive in meeting information security requirements," OIG states. "The CISO held nine staff meetings in the first 6 months after his arrival. IRM/IA staff commented that those meetings normally do not provide clarity on what the CISO considers to be office priorities. Many staff commented that they are unaware of the CISO's activities in general and are unable to obtain those answers since he is not seen regularly in the office."

The audit's recommendations to IRM/IA total more than 30 formal directives and several informal ones as well. Chief among them was requesting the Bureau of Human Resources to direct the Office of Resource Management and Organizational Analysis to conduct an organization assessment of IRM/IA, and determine what similar functions are being performed by other State Department offices.

The OIG also said that IRM/IA needs a mission statement that includes short-term and long-term priorities and goals for its office and each of its three divisions.

A State Department spokesman said little in response to FCW, writing in a brief statement: "The Department takes the OIG feedback seriously and is committed to addressing the recommendations and the concerns that led to the assessment."