SIIA Welcomes Progress on Federal IT Acquisition Reform; Expresses Lingering Concerns

SIIA today welcomed the advancement of federal IT acquisition reform. Earlier today, the House of Representatives passed an amendment (Amendment #166) authored by Chairman Darrell Issa (R-CA) and Rep. Gerry Connolly (D-VA) of the House Oversight and Government Reform Committee adding the language of the Federal IT Acquisition Reform Act (FITARA) to the FY 2014 National Defense Authorization Act.  With this action the proposed reform has taken another step forward, but SIIA continues to have concerns with a number of provisions in the bill.

Federal IT acquisition reform is long overdue, and we appreciate the work of Chairman Issa, Rep. Connolly and their respective staffs to recognize the critical need for reform move it forward. FITARA puts in place needed changes in IT acquisition, including increasing the authority of federal CIOs, promoting data center optimization, and recognizing the importance of a highly trained IT acquisition workforce.

SIIA has worked closely with Chairman Issa and other members of the Committee to revise the legislation since its March mark-up, while the Committee has moved forward with many of the changes, including those that preserve the important role of Value Added Resellers (VAR) in the federal market, the organization  remains concerned about the net effect of the changes to the language around the use of open source software and the language that would alter the application of FISMA by, in essence, codifying the FedRAMP program.

While SIIA is pleased to see FITARA move forward and remains supportive of its overall objectives, we still have concerns with a number of specific provisions. We have expressed our concerns to the committee and look forward to continuing to work with Chairman Issa and interested members in the U.S. Senate to resolve these lingering issues, and ensure that the bill has the intended positive impact on the federal IT marketplace.


Michael Hettinger is VP for the Public Sector Innovation Group (PSIG) at SIIA. Follow his PSIG tweets at @SIIAPSIG. Sign up for the Public Sector Innovation Roundup email newsletter for weekly updates.

Public Sector Innovation Roundup

FedRAMP approves two more cloud vendors: On June 6th, GSA announced that two more cloud service providers, HP and Lockheed Martin, had received their provision authorization through the FedRAMP program. These two approvals bring the total number of FedRAMP approved CSPs to five and marks the second time in just over two weeks that FedRAMP approvals were issued, with Amazon gaining approval via the agency (HHS) ATO process on May 21st. Learn more at GSA.gov.

Secret Service wants an app store: The Secret Service released an RFI on May 29th requesting information supporting the acquisition of services and supplies to provide Mobile Device Management (MDM) / Mobile Application Store (MAS) solutions. The mobile app store capability would securely support a range of mobile operating systems for the service. The RFI says the Secret Service has more than 12,000 mobile devices, running on a variety of operating systems including Blackberry OS, Android iOS, and Windows. In assessing the solutions the service is looking for options that have enterprise level controls to support mission requirements and assist in the overall development of the agency’s mobile strategy. Responses are due June 29th. See the RFI here

NRC getting ready to move to the cloud: The Nuclear Regulatory Commission is in the process of developing a strategy to move some of its core IT operations to the cloud. NRC released a sources sought notice earlier this year and is currently reviewing those responses. It is expected that NRC will move forward with infrastructure as a service, hosting and other capabilities. With the sensitivity of much of NRC’s data, special attention is being paid to what can be effectively and securely hosted in the cloud. The move follows prior cloud implementations including moving NRC’s core financial system to the cloud. Expect to see more and potentially a solicitation later this summer. Federal News Radio has more.

GSA to pilot cloud brokerage: GSA announced plans late last month to launch a cloud broker pilot by fall 2013. DHS is one of two agencies committed to helping GSA test the model, with the second participating agency remaining unnamed. All in all 15 agencies are part of the cloud broker discussion according to GSA. GSA announced that it plans to award one contract for the pilot program and then reevaluate at the end of the year. SIIA and many other organizations have expressed some reservations about the cloud broker model, in large part because GSA has yet to define the services the cloud broker will provide in the federal market. No additional detail was provided when GSA made the announcement. See Federal Times FedBlog for additional information.


Michael Hettinger is VP for the Public Sector Innovation Group (PSIG) at SIIA. Follow his PSIG tweets at @SIIAPSIG. Sign up for the Public Sector Innovation Roundup email newsletter for weekly updates.

Public Sector Innovation Roundup

Amazon gets FedRAMP seal of approval: Earlier this week, Amazon Web Services (AWS) became the third cloud service provider and the second large company to receive its FedRAMP certification. AWS, unlike the previous two companies to receive FedRAMP certification did so by working through an existing ATO with the Department of Health and Human Services, whereas the others went via the GSA FedRAMP and JAB approval process. The certification is a step in the right direction for the program and shows there’s more than one way to get through the FedRAMP process. Read more here from FCW.

Rep. Issa introduces, committee passes DATA Act: Rep. Darrell Issa (R-CA), Chairman of the House Oversight and Government Reform Committee has introduced a revised version of his DATA Act. The bill, which stalled in the Senate in the last Congress in part because of the cost to implement, sets standards for the publication of federal spending data on www.USASpending.gov. The bill was released in draft form last week, introduced on May 21st and passed unanimously by the House Oversight and Government Reform Committee on May 22nd. FCW has the recap.

Changes at OMB to impact federal IT: The last few weeks have brought a lot of change to the Office of Management and Budget (OMB) with OMB Controller Danny Werfel being appointing Acting IRS Commissioner and Federal CIO Steve VanRoekel moving up to be Acting Deputy Director for Management while maintaining his CIO title. VanRoekel replaces Jeff Zients who resigned earlier this month. Read more from Federal News Radio.

SIIA Releases White Paper on Data Driven Analytics: On Monday, SIIA released a white paper that provides an in-depth look at the benefits and challenges of data-driven innovation along with a detailed public policy roadmap. SIIA crafted the white paper to provide guidance to help policymakers understand and enable the economic and social value of data-driven innovation. Recognizing that data collection and use is at crossroads, and decisions by policymakers could have an enormous impact on American innovation, jobs and economic growth, SIIA believes it is essential for policymakers to recognize that data-driven innovation presents an economic growth engine that is revolutionizing our lives and will create 1.9 million U.S. jobs by 2015. At the same time, we have to address the very legitimate questions about the storage and use of data without strict regulation that stifles economic opportunity. With this paper, SIIA has taken a comprehensive look at the issue – providing significant analysis of where the opportunities lie with data and what needs to be done to unlock its full potential. The full white paper is available here.

SIIA Responds to Cybersecurity RFI: Earlier this week SIIA submitted comments in response to Executive Order 13636 – Improving Critical Infrastructure Protection, issued on February 12, 2013. The RFI and SIIA’s comments specifically address proposed implementation of Section 8(e) of the Executive Order. While SIIA supports the overall effort to improve the cybersecurity posture of the federal government, we have concerns that this provision has the potential to negatively impact the federal acquisition landscape by requiring additional cybersecurity measures beyond what is currently required by FISMA and the FAR.


Michael Hettinger is VP for the Public Sector Innovation Group (PSIG) at SIIA. Follow his PSIG tweets at @SIIAPSIG. Sign up for the Public Sector Innovation Roundup email newsletter for weekly updates.

SIIA Responds to RFI on Acquisition Provisions in Cybersecurity Executive Order

Earlier this week SIIA submitted comments in response to the proposed implementation of Section 8(e) of Executive Order 13636 – Improving Critical Infrastructure Protection, issued on February 12, 2013.  We greatly appreciate the opportunity to provide formal comments to GSA and DOD on this critical section of the Executive Order.

SIIA shares the overall goals of the Administration in developing a cybersecurity framework that improves our ability to protect government information and critical infrastructure from cyber-attacks.  In fact, many SIIA members provide products and services that protect businesses, consumers and public sector entities from cyber-attacks, viruses and a wide-range of online security threats.  As a result of this experience, these members have a critical voice in the debate on the implementation of Section 8(e) of the Executive Order.  While we recognize the importance of the overall goals of the Executive Order we have some significant concerns regarding the potential effects of its implementation as proposed in the RFI.

Most notably, we have an overarching concern that the RFI itself does not accurately reflect the carefully crafted definition of “critical infrastructure” reflected in the Executive Order.  Instead the RFI appears to sweep all IT companies or their customers into the same regulatory basket as the most critical systems.  This distinction is crucial as not all systems and assets should be required to comply with this level of regulation.

In addition, SIIA expressed concerns in our comments about how the development of a broad cybersecurity framework, an ongoing process at NIST, may impact sector-specific guidance such as what is proposed here for government contractor / acquisition sector.  As a result, we have requested that the implementation of Section 8(e) be delayed until NIST cybersecurity framework has been fully developed.

Furthermore, we support the “common criteria” as a globally recognized, effective solution to a rapidly changing IT marketplace, we caution the Administration to avoid  establishing any new, overly prescriptive supply chain or software assurance scheme that would establish the Government as a leader in the process of developing technology or the would create a US centric standard, as this would conflict with the proven security regime that has long been the foundation of our national security strategy.

We also point out concerns about how that which is proposed in this Executive Order may impact the consistent, accepted, risk-based government cybersecurity requirements contained in FISMA.  Beyond its impact on FISMA, the Executive Order may also overlap with and be redundant to the FedRAMP program, potentially subjecting any Internet-enabled computing services utilized by the government to new baseline security assessments, on top of the existing FISMA and FedRAMP requirements. Not only would this practice be costly, slow, and inefficient, but it could lead to new technology-specific overlays for services that are already being utilized and assessed by the federal government in a technologically-neutral way.

Lastly, we highlight our concerns regarding the potential effect of the rules proposed as a result of the Executive Order on the other major cyber-related requirements, both current and proposed, including those found in the FAR, the DFARS, FISMA and the last two National Defense Authorization Acts.


Michael Hettinger is VP for the Public Sector Innovation Group (PSIG) at SIIA. Follow his PSIG tweets at @SIIAPSIG. Sign up for the Public Sector Innovation Roundup email newsletter for weekly updates.

White House Open Data Policy: Promoting Openness and Interoperability

The U.S. Federal Government, state and local governments, and governments around the world possess treasure troves of valuable data that have gone largely untapped for many years.  More than ever before, citizens want access to government data, and they want it applied in innovative ways to which they are increasingly becoming accustomed.

Government’s acceptance and utilization of new technologies is needed to enhance government’s mission.  Technologies that leverage data analytics to provide innovative functions and services hold the key for governments to provide improved services and to better understand how well they are fulfilling their missions.

Today, the White House issued an Executive Order Making Open and Machine Readable the New Default for Government Information” and an OMB Memorandum (M-13-13) updating the Digital Government Strategy, originally published last May.  The updated policy seeks to further enhance the government’s open data initiative, making machine readable data the default for government data, while helping to establish a framework for effective information management at each stage of the information’s lifecycle to promote openness and interoperability.

Specifically, this Memorandum requires agencies to collect or create information in a way that supports downstream information processing and dissemination activities. This includes using machine readable and open formats, data standards, and common core and extensible metadata for all new information creation and collection efforts.  It also includes agencies ensuring information stewardship through the use of open licenses and review of information for privacy, confidentiality, security, or other restrictions to release. Additionally, it involves agencies building or modernizing information systems in a way that maximizes interoperability and information accessibility, maintains internal and external data asset inventories, enhances information safeguards, and clarifies information management responsibilities.

Beyond open data, governments need to embrace policies that enable a streamlined approach to innovative applications that draw from and analyze this data.  This emphasis on data analytics leads to data driven innovation (DDI) allowing governments to use data to improve the efficiency and effectiveness of government, as well as preventing waste, fraud and abuse.  Embracing open data, as the White House has done through the issuance of this policy, maximizes the full potential of DDI for governments to embrace open data policies, use public-private partnerships to provide access to critical public data, and to adopt enterprise architectures that enables sharing.  These steps will put public sector data to innovative uses that can reap the economic and societal benefits of DDI.

We applaud the efforts of the Administration that led to this policy and encourage the White House to continue to embrace open data policies, while also embracing policies that increase the use of data analytics—pulling data from myriad sources—to make strategic decisions, to encourage research and development around data science, and encourage teaching and training for data scientists and professionals with strong data analytics skills that are already in high demand in both the public and private sectors.


Michael Hettinger is VP for the Public Sector Innovation Group (PSIG) at SIIA. Follow his PSIG tweets at @SIIAPSIG. Sign up for the Public Sector Innovation Roundup email newsletter for weekly updates.

Public Sector Innovation Roundup

White House releases updated open data policy: On May 9th, the White House released an update to last year’s memorandum on open data and the resulting Digital Government Strategy. The new policy, accompanied by an Executive Order, aims to make machine readable data the default for government data, while helping to establish a framework for effective information management at each stage of the information’s lifecycle to promote openness and interoperability. See the OMB memo here.

Spires resigns as DHS CIO: After nearly two months on leave, DHS CIO Richard Spires officially resigned from the agency this week. No reason for the resignation was given. Spires had been at DHS for nearly 3 ½ years and in addition to his responsibilities at DHS, also served as Vice Chair of the CIO Council. While the rumors have been rampant about the reasons for his extended leave, most of the speculation has focused on a general dispute with senior DHS officials over the role and authority of the CIO, a subject sure to come more to the forefront as a result of this situation. Earlier this week, FCW published an op-ed that I penned on the evolving role of the federal CIO, which is linked here and FCW has full coverage of the Spires story here.

Jeff Zients steps down from OMB post: Jeff Zients, who had been Acting Director of OMB for more than a year, prior to Sylvia Burwell’s confirmation a couple weeks ago, announced that he was stepping down as Deputy Director effective May 1st. Zients, a former management consultant, was the nation’s first Chief Performance Officer, in addition to being the Deputy Director for Management. Lisa Brown has been handling the CPO duties while Zients has been acting OMB director. Zients departure, along with that of performance guru Shelley Metzenbaum, announced last week, leaves a significant gap in the “M” and OMB. No word yet on what the Administration plans to do to fill these positions, nor is there any word on what’s next for Zients who at one time had expressed interest in being the US Trade Representative. Federal Times has the story.

NIST issues updated security controls for federal IT systems: On April 30th NIST issued an update to the federal systems security controls contained in NIST Special Publication 800-53, Security and Privacy Controls for Federal information Systems and Organizations. The updated policy, the forth update to SP 800-53 and the first since 2009, addresses issues such as mobile and cloud computing, applications security, supply chain risks and privacy concerns. It also calls for maintaining routine best practices to reduce information security risks and pushes a renewed emphasis on secure software development. See the full text here.

FOSE to kick off May 14th: The annual FOSE Conference being held at the Walter E. Washington Convention Center is set to kick off a big week for federal IT. General Stan McCrystal will open the conference with a keynote presentation on Tuesday morning followed by three full days of conference sessions on cloud, mobile, cybersecurity, and big data. Other keynotes include former Redskin quarterback Joe Theismann, Senator Tom Carper (D-DE), Chairman of the Senate Committee on Homeland Security and Governmental Affairs and Federal CIO, Steve VanRoekel. Yours truly will be moderating a session on leveraging government-wide acquisition vehicles (GWACS) to acquire cloud on Tuesday afternoon and SIIA is hosting a reception for conference attendees on Wednesday, May 15th. See more at the FOSE website.

Michael Hettinger is VP for the Public Sector Innovation Group (PSIG) at SIIA. Follow his PSIG tweets at @SIIAPSIG. Sign up for the Public Sector Innovation Roundup email newsletter for weekly updates.

The Evolving Role of the Federal CIO

Last week, I wrote about the ever-changing job of the federal CIO for FCW. Despite how crucial the role is, for many federal agencies the CIO is hampered by bureaucracy. As I write in the op-ed:

When the Government Accountability Office interviewed 30 CIOs at major agencies in 2011, only 56 percent said they had direct access to the agency secretary or administrator, down from 70 percent in 2004. Combine that downward trend with the proliferation of other chiefs and it’s easy to see that CIOs are struggling in a crowded management environment.

Because CIO is perceived as an “IT geek” rather than a strategist and business partner, their contributions are ignored and their need for control and information unmet. The result is an ineffective structure limiting the CIO’s ability to successfully govern the data at hand.

So what’s the solution? Based on my previous experience as staff director of the House Oversight and Government Reform Committee’s Government Management subcommittee, I suggest empowering the CIO by leveraging the same model used to empower the CFO, namely the statutory requirements of the CFO Act, as applied at the Department of Homeland Security through legislation I drafted 9 years ago.

Our argument was simple: If we expected the CFO at DHS to play a major role in shaping [DHS’s] financial future, that person needed access to the top. We recognized that the only way to ensure that this would happen was to put it in statute. The same argument now holds true for federal CIOs.

As the government continues to incorporate data into its day-to-day operations, the CIO will serve as an important figure. The federal government needs to give CIOs the power necessary to control and understand the wealth of data that can be used for a more efficient and productive government entity.


Michael Hettinger is VP for the Public Sector Innovation Group (PSIG) at SIIA. Follow his PSIG tweets at @SIIAPSIG. Sign up for the Public Sector Innovation Roundup email newsletter for weekly updates.