Herding the stray cats of federal IT ambitions

concept cybersecurity art

Most government agencies are embracing the benefits of cloud computing, a mobile workforce and cybersecurity measures to protect critical networks and assets. But in many cases it has been a struggle just to get to that point, and hurdles remain as different approaches present a fragmented federal IT security picture.

Some help in federating the ways government agencies implement security practices will emerge in the forthcoming final version of the National Institute of Standards and Technology’s cybersecurity framework, due next month. But some experts are advising additional measures to help the government get to a comprehensive management plan for IT security.

A new report advocates a more integrated approach that moves away from compliance-based security and toward a risk-management paradigm that coordinates cross-government efforts.

“There are a lot of initiatives that agencies are responsible for, which the paper tries to highlight – cloud first, data center consolidation, continuous diagnostics and mitigation, mobility management, a whole bunch of things agencies are responsible for,” said report co-author Karen Evans, national director for the U.S. Cyber Challenge. “One major theme in our recommendations is taking a look at that and building out the architecture in order to ensure [success]. If you’re looking at these initiatives separately and try to implement them separately without looking at the integrated picture, it’s going to defeat the purposes of them.”

The first recommendation in the report calls on the Information Security and Identity Management Committee (ISIMC), part of the Federal CIO Council, to take on a leadership role by adopting and issuing integrated network architecture. It also asks the ISIMC to establish FISMA-friendly implementation plans with milestones to help agencies transition to the proposed architecture.

“Right now there’s no overarching document saying, ‘this is how all these things can potentially work together,’” Evans said. “The pool of knowledge at the Federal CIO Council can help create the documents to lay out a specific roadmap that agencies can develop and be held accountable for.”

A second recommendation targets FedRAMP, calling on the Joint Authorization Board to require cloud service providers contracting with the government to “employ penetration testing capabilities in the implemented operational environment in order to surveil, analyze and respond to threats in real-time.”

This is especially important as FedRAMP deadlines approach, Evans noted.

“Right now everyone is scrambling, what does it mean?’ This architecture would help identify [security] gaps and how to get there – ‘here’s where I am and here’s where the gap is to get to my outcome, and here’s my plan to close that gap,’” she said.

Under the recommendations, the Joint Authorization Board’s current role in governing FedRAMP and certifying cloud providers for the General Services Administration would be reinforced and broadened, ensuring that providers and their services meet requirements and policies for other agencies as well.

“The nice thing about that is it’s a proven model,” said Julie Anderson, another co-author of the report and managing director of Civitas Group. “We’re not proposing something new; we’re proposing integration of processes and how FedRAMP can be integrated into requirements and expectations.”

The report additionally calls on the Office of Management and Budget and Homeland Security Department to jointly establish metrics that inspectors general can use to measure agencies’ cybersecurity risk and program effectiveness.

“There are so many initiatives, all with good intentions – we’re trying to weave that together into an integrated approach so agencies can look at all of the policies and directives and have an understanding of what they need to do next to meet requirements,” Anderson said.

About the Author

Amber Corrin is a former staff writer for FCW and Defense Systems.

The 2015 Federal 100

Meet 100 women and men who are doing great things in federal IT.


  • Shutterstock image (by venimo): e-learning concept image, digital content and online webinar icons.

    Can MOOCs make the grade for federal training?

    Massive open online courses can offer specialized IT instruction on a flexible schedule and on the cheap. That may not always mesh with government's preference for structure and certification, however.

  • Shutterstock image (by edel): graduation cap and diploma.

    Cybersecurity: 6 schools with the right stuff

    The federal government craves more cybersecurity professionals. These six schools are helping meet that demand.

  • Rick Holgate

    Holgate to depart ATF

    Former ACT president will take a job with Gartner, follow his spouse to Vienna, Austria.

  • Are VA techies slacking off on Yammer?

    A new IG report cites security and productivity concerns associated with employees' use of the popular online collaboration tool.

  • Shutterstock image: digital fingerprint, cyber crime.

    Exclusive: The OPM breach details you haven't seen

    An official timeline of the Office of Personnel Management breach obtained by FCW pinpoints the hackers’ calibrated extraction of data, and the government's step-by-step response.

  • Stephen Warren

    Deputy CIO Warren exits VA

    The onetime acting CIO at Veterans Affairs will be taking over CIO duties at the Office of the Comptroller of the Currency.

  • Shutterstock image: monitoring factors of healthcare.

    DOD awards massive health records contract

    Leidos, Accenture and Cerner pull off an unexpected win of the multi-billion-dollar Defense Healthcare Management System Modernization contract, beating out the presumptive health-records leader.

  • Sweating the OPM data breach -- Illustration by Dragutin Cvijanovic

    Sweating the stolen data

    Millions of background-check records were compromised, OPM now says. Here's the jaw-dropping range of personal data that was exposed.

  • FCW magazine

    Let's talk about Alliant 2

    The General Services Administration is going to great lengths to gather feedback on its IT services GWAC. Will it make for a better acquisition vehicle?

Reader comments

Thu, Jan 23, 2014 Owen Ambur Hilton Head Island, SC

SafeGov's recommendations are now available in StratML format at or, more specifically, Facilitating strategic alignment and performance accountability are among the purposes of the StratML standard.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above