Oversight

State Department IG highly critical of IT sub-bureau

William Lay

William Lay, the chief information security officer at the State Department, has not addressed critical management issues and is frequently away from the office, according to the inspector general.

When running a department, it is a good idea to have a mission statement, strategic planning and a workload that justifies its organizational structure and the millions of dollars of taxpayer money it receives each year.

The State Department's Bureau of Information Resource Management, Office of Information Assurance (IRM/IA) has none of those things, according to a State Department's Office of Inspector General audit released in July, and further lacks controls and procedures to monitor contracts, task orders and blanket purchase agreements totaling $79 million.

IRM/IA, established in 2003 to comply with the Title III of the E-Government Act, was formed to address information security requirements, yet OIG found the majority of those functions are performed in other State Department offices.

Download

Read the report.

The audit criticized the bureau's certification and accreditation operations (C&A) because mishandling of these processes – as well as guidance and reviews of C&A packages – contributed to expired authorizations to operate (ATOs) for 52 of the State Department's 309 systems. Some delinquent systems have been operating on expired authorizations for more than two years, the audit states.

IRM/IA – with its staff of 22 full-time employees and 36 contract employees, and its $10 million operating budget – plays a lead role in overseeing the State Department's cyber-security program, including information assurance policies, standards and guidelines, and compliance with national security directives.

Yet its sister departments do most of the heavy lifting, the OIG report states, including management and oversight of the State Department's information systems, which include its classified and unclassified networks. Personnel in other IRM departments are responsible keeping watch against cyber-attacks and risk measures, as well as desktop security guidelines.

"IRM/IA performs a limited number of information assurance functions, does not have a lead role in most of the functions it does perform and, for the most part, only compiles information generated by others," the report states, before concluding the bureau's realignment request to create a fourth division was not justified.

"In light of the lack of active involvement in many of its stated responsibilities, the proposed IRM/IA office realignment for an additional deputy position and one more division, as well as the need for some of the current divisions, are not justified by the current level of work being performed," the audit states. Not surprisingly, the audit was critical of the bureau's head, Chief Information Security Officer William Lay, who accepted the position in September 2012. Lay, the report stated, did a good job on arrival rebuilding relationships internally and externally with IRM/IA, but he has not addressed critical management issues. He also isn't in the office much, according to OIG, so staff is often left wondering what to do.

"The CISO has not provided division chiefs with priorities based on defined goals, as a result, the staff is not proactive in meeting information security requirements," OIG states. "The CISO held nine staff meetings in the first 6 months after his arrival. IRM/IA staff commented that those meetings normally do not provide clarity on what the CISO considers to be office priorities. Many staff commented that they are unaware of the CISO's activities in general and are unable to obtain those answers since he is not seen regularly in the office."

The audit's recommendations to IRM/IA total more than 30 formal directives and several informal ones as well. Chief among them was requesting the Bureau of Human Resources to direct the Office of Resource Management and Organizational Analysis to conduct an organization assessment of IRM/IA, and determine what similar functions are being performed by other State Department offices.

The OIG also said that IRM/IA needs a mission statement that includes short-term and long-term priorities and goals for its office and each of its three divisions.

A State Department spokesman said little in response to FCW, writing in a brief statement: "The Department takes the OIG feedback seriously and is committed to addressing the recommendations and the concerns that led to the assessment."

Featured

Reader comments

Wed, Jul 24, 2013

Steufert's position at DHS is "Director of National Cybersecurity Division". Also, Booz Allen is the prime contractor in IRM/IA, responsible for performing C&A.

Wed, Jul 24, 2013 Michael Hardy

Reporter Frank Konkel responds to some of your comments in our new blog, The Conversation. Go there to read his thoughts on the matter.

Tue, Jul 23, 2013

Another "great" story by FCW. No wonder folks don't want to go into government service. s there an award for worst hit piece of the year?

Tue, Jul 23, 2013

This article and the report are totally unfair to the CISO. Mr. Lay just arrived only months before this inspection, and inherited decisions from other people already departed. I am glad there are some positive things in this, but this seems to be placing a lot of blame on the CISO, without even letting him settle in and sort out the pieces left behind.

Tue, Jul 23, 2013

John Streufert, along with his duo crew, George Moore and Danny Toler.

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above