OMB Finishes Major Tech Policy Overhauls in 2019

Since joining the administration, federal Chief Information Officer Suzette Kent has made it her mission to revamp and revitalize the government’s aged IT policies, and 2019 was the year it all came together.

The Federal CIO’s Office reworked and released six policies this year, some of which had gone nearly a decade without an update.  

Cloud Smart

The single most important IT document of 2019—and second only behind the IT Modernization policy for the entirety of the Trump administration—was the release of the finalized Cloud Smart policy. The document builds on the Obama administration’s Cloud First, issued in 2010.

Cloud Smart looked to bring the government’s cloud policy forward by offering harder definitions of what counts as cloud services. After the initial draft received public comments and went through internal debate, the finalized policy released in June was similar to the original draft but contained several important changes.

First among them—at least in order of appearance—was the inclusion of application rationalization as a discipline for all federal agencies. The final policy included a section on reviewing agency app portfolios and making strategic decisions about when, how and where to migrate. The Federal CIO Council also released an Application Rationalization Playbook to help agencies get started.

The finalized policy also clarified the administration’s position on the use of private versus public clouds—that is, infrastructure owned by agencies versus private sector companies. The policy makes it clear there is no one answer, causing some consternation among industry, which continues to lobby for fewer government-owned systems and more as-a-service offerings.

Data Center Optimization

Hand-in-hand with the Cloud Smart policy, OMB released the final version of its Data Center Optimization Initiative, the administration’s replacement for the Federal Data Center Consolidation Initiative started in the Obama years. The new policy came with a new set of metrics for agencies to be measured against and a prohibition from opening new agency-owned data centers without checking with OMB first.

However, some stakeholders, including Reps. Gerry Connolly, D-Va., and Mark Meadows, R-N.C., took issue with OMB’s apparent shift from focusing on closing data centers to optimizing them.

“The intent of the law was always to identify how many data centers we have—which was a struggle—and then cut them in half, and then cut them in half again,” Connolly said during a hearing in June, suggesting that the new policy is “skirting the intent of the law.”

“What is it that OMB is doing in emphasizing optimizing and exempting from our audit, here, 80% of the data centers that exist?” Connolly asked Kent at the hearing. “Because we’re afraid that, whatever your intent, the consequence is we won’t capture that and we will not effectuate the savings the law was intended to encourage.”

According to Kent, as the data center count grew, it began to contain things that shouldn’t move to a cloud environment, such as printers, weather stations, MRI machines and “things that weren’t actually classified as a data center.”

“We also understand—and very clearly from talking with agencies—there are some reasons where we will continue to operate a data center: a supercomputer site, something that is needed for resiliency, special needs of agencies that we believe are very important,” she said. “We want to ensure that those are being operated efficiently and securely with the intent of this committee.”

Identity, Credential and Access Management

The third pillar of the administration’s infrastructure policy push was a reskin of the Identity, Credential and Access Management, or ICAM, policy, which establishes how agencies should manage who is on their networks and what access those people—or other form of entity—should have.

The policy update shifts the government’s thinking about how users are accessing networks—something that would come up again in the Trusted Internet Connection policy update—prompting agencies to be more nimble in their management of those entry points.

“While hardening the perimeter is important, agencies must shift from simply managing access inside and outside of the perimeter to using identity as the underpinning for managing the risk posed by attempts to access federal resources made by users and information systems,” the policy states.

The policy also instructs agencies to open their thinking as to who or what needs to be credentialed. As of the May release of the final policy, agencies have to consider credentials and specific privileges for employees, as well as devices and bots doing work on the network.

Shared Services

One of the biggest policy shifts of the year and the Trump administration was the issuance of the “Centralized Mission Support Capabilities for the Federal Government,” a new regime for shared services delivery across government.

The new shared services policy established Quality Service Management Offices, or QSMOs, to lead functional areas such as payroll, cybersecurity, grants management and accounting—some of which are already managed through shared services providers. The big change under the QSMOs will be a more centralized approach to managing how government administers these services while still offering agencies choices.

Currently, shared services like payroll are managed independently by a few large agencies, which others can opt to take advantage of. Under the QSMO regime, a single agency will lead each functional area, offering services to interested agencies while also managing a broader marketplace, which will include pre-vetted commercial offerings and a set of standards to be applied across government.

The goal is ambitious, but federal officials—including the outgoing governmentwide shared services lead—are optimistic that this time they have shared services figured out.

Federal Data Strategy and Action Plan

In June, the administration released the final list of principles and practices that guide how agencies should be using data as a strategic asset. That release included the draft of a first-year action plan giving agencies and governmentwide teams 16 specific deliverables to hit before August 2020. 

The final version of the Year One Action plan was continually delayed. But two days before Christmas, OMB released the final plan, adding four more items for around 20 actions due in 2020.

OMB consulted heavily with stakeholders, including agency data leads and frontline employees, industry and academia, all of which were outlined in a document detailing the collaborative efforts. The result is a Federal Data Strategy that includes 10 principles and 40 practices to guide agencies through the next 10 years, along with the 20 action items to be accomplished in 2020. 

Trusted Internet Connection 3.0

In September, the office released the final version of the Trusted Internet Connection 3.0 policy, outlining how agencies can ensure employees and their devices are connecting to federal networks securely. The update comes seven years after the release of TIC 2.0, a time span during which much has changed.

The new policy acknowledges that most employees are not always connecting to agency networks through the computer at their desk. Modern workstreams include connecting to the network with several devices—desktops, laptops, smartphones, thin clients, etc.—and from anywhere in the world. As agencies employ more cloud computing environments, even the network itself is less tangible

To account for these changes, TIC 3.0 is built around use cases showing different kinds of connections and various ways to ensure they are secure. Use cases fall into four broad categories: traditional, cloud, agency branch office and remote users.

While the TIC policy was officially finalized, it left the work of codifying the use cases to the Homeland Security Department and Federal Chief Information Security Officers Council. Homeland Security officials with the Cybersecurity and Infrastructure Security Agency, or CISA, released a draft set of guidelines—including the use cases—just before the holidays.

The five-volume set of draft guidance is open for public comment through Jan. 31.