OMB preparing to open shop for IT security LOB

The Office of Management and Budget hopes to begin setting up several lines of business for IT security in the next fiscal year, with the selection of the first centers of excellence.

The task force established to develop the new line of business expects that at least a dozen agencies will be named centers of excellence for various security functions, allowing them to market their expertise to other agencies, said task force member George Bonina, the Environmental Protection Agency’s chief information security officer (CISO).

“If you are not a center of excellence for a particular function, you will have to be a customer of a center and your business case will have to reflect that in each of the areas,” Bonina said Tuesday at the Federal Information Assurance Conference being held at the University of Maryland.

A line of business is a necessary business function that typically is outside of agencies’ primary missions, such as financial management or, in this case, cybersecurity. Rather than have each agency duplicate non-essential functions, OMB designates agencies that have shown expertise in these areas to provide them to other agencies on a fee-for-service basis.

Improving performance in IT security is becoming more important. Despite a growing awareness of the need to improve security of the government’s information systems, federal spending on security has been static, at about $4.2 billion a year for the last three years, while total IT spending has been slowly growing, according to OMB estimates.

In March, OMB set up a multi-agency task force with a goal of establishing a security line of business during the fiscal 2007 budget process. The task force has representatives from 34 agencies, most of them at the CISO level, Bonina said. The task force has recommended establishing a governance board that would oversee a line of business project office. The project office would set criteria and establish performance measures for those agencies designated centers of excellence. Multiple centers would be designated for each of four problem areas identified by the task force:
  • Security training, to standardize security processes, develop common criteria and help provide a career path for information security professionals in government.

  • FISMA reporting, to standardize reporting processes and help ensure consistent and effective IT program management.

  • Situational awareness and incident response, to improve the sharing of information about IT vulnerabilities and threats and provide resources for responding to security incidents.

  • Lifecycle security solutions, to provide a common methodology for evaluating security tools, so each agency does not have to go through the process from scratch each time it acquires security products or services.

Bonina said the task force hopes to have at least three centers of excellence for each of these problem areas, “so there will be competition to improve performance and drive costs down.”

The centers of excellence will not replace existing IT security programs and resources, such as the U.S-Computer Emergency Readiness Team. It is expected that agencies applying to be centers of excellence would contract with private sector partners to help provide a full range of tools and services.

Agencies can propose to become a center of excellence in the IT business case submitted with their 2007 budget requests. Those agencies not proposing to become centers of excellence in a given area will have to outline in the budget request their plans for transitioning those functions to a designated center when they open for business. The requirement for using the services of a center of excellence probably will be phased in over a two or three year period to allow for existing contract obligations and other commitments of agencies.

Because this process is part of the budget process, it is shrouded in secrecy “until it becomes public in the president’s budget,” which is expected to be presented to Congress in February 2006, Bonina said.

But Bonina did say that OMB hopes to select centers of excellence for the FISMA and training components late in fiscal 2006, with selections for situational awareness and incident response and lifecycle security solutions in 2008.

About the Author

Connect with the GCN staff on Twitter @GCNtech.


  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.