Issue 7: July 25, 2006

• CIO Spotlight: Michael W. Carleton, U.S. General Services Administration



• E-Gov Initiatives: OMB releases Federal Transition Framework for cross-agency initiatives



• Policy: OMB directs agencies to protect sensitive agency information and report incidents within one hour



• FISMA: OMB issues reporting instructions for FISMA and privacy management



• GAO report calls for stronger processes for identifying and overseeing high-risk IT projects



• HSPD-12: Many developments help agencies meet OMB deadlines



• International: OASIS international standards body ratifies emergency data standard



• State Government: NGA grants support 6 State information-sharing projects



• Local Government: Survey ranks 100 large cities worldwide in digital governance



• The Buzz: Computerworld's "100 Best Places to Work in IT" lists only 3 government organizations for 2006



• Kudos: 7 government programs earn Innovations in American Government Awards; 9 earn FCW Pioneer Awards



• Transitions: Changes in the IT Community



• Upcoming Events Calendar



• Comments: We welcome your feedback at dotgovbuzz@gsa.gov.

Like many Federal agencies, GSA has experienced tremendous changes over the past five years. Mike Carleton has been in the middle of it. "Organization change requires continuity and sustainability," he said. "What we've done at GSA in capital planning and investment, security and EA [enterprise architecture] over the last few years has had a tremendous effect on the culture at GSA." As one of the longest serving CIO's in the Federal Government, having served as the GSA CIO for more than 5 years, Carleton has created a goal-oriented office that is focused on the future while it manages for today.

Carleton came to GSA from the Department of Health and Human Services, where he served as CIO for the Office of the Secretary and Deputy Director for Information Resources Management. He became GSA's CIO in October 2000, after a brief tenure as Acting CIO for the GSA Public Buildings Service.

He is pleased that the GSA CIO has "a seat at the table" and can participate in strategic decision-making at the top level of the agency. However, he views his responsibilities for running the agency's $500 million IT program as paramount.

"I retain a substantial operational role at GSA running shared IT services that has to work reliably before I can expect others to want to hear from me about strategic issues," he said, noting the three main operational challenges he faces:

• Since GSA spends a relatively high percentage of total IT costs on operating and maintaining existing systems, and a relatively small percentage on new systems and enhancements, it is hard to drive down IT operating costs enough to finance innovation during time of tight budgets;
• Keeping up with the data security needs of the agency in the face of a constant stream of evolving threats; and
• Using enterprise architecture to enable agility and management controls for the implementation of the agency's business strategy.

Establishing a business strategy requires the integration of many internal perspectives, Carleton pointed out. It also requires looking at your organization from the customer's viewpoint. "We have a substantial EA program now, and we're looking at value chains from the customer's perspective. That will allow us to look at how best to implement business strategies from the perspective of work processes, human capital improvement, IT investments, and the complementary roles of our customers and suppliers all in relation to each other."

In meeting these challenges he is focused on performance and team building, the cornerstones of his avocational life as a competitive amateur soccer player and team captain at Boston University. As leader of an office of more than 120 staff, his ultimate goal is "create an organization that has the capacity to deliver service and to successfully adapt going forward."

"I'm proud of the quality of service, reliability, and customer satisfaction of this office," he said, citing a recent Gartner study that found the cost and quality of GSA's infrastructure operations compare favorably with similar large and complex private sector organizations. Carleton believes these favorable benchmarks translate into customer satisfaction, which is reflected in the 88% favorable customer satisfaction score his office received in 2005.

These days, he is focused on getting to "green," as in the OMB Scorecard. GSA is heavily involved in implementing the President's Management Agenda, particularly its initiatives for expanding e-government. Carleton and project managers throughout GSA are leading the implementation of five of the Presidential E-gov initiatives, and participating in seven others. "We're close to green status right now," said Carleton. "We're making steady progress on our EA maturity assessment, the Earned Value Management program, and these E-gov initiatives." GSA is also center of excellence for the Financial Management Line of Business, and Carleton is involved in helping to consolidate agencies' financial management systems. GSA's EA was also the first to go to "green" based on business process model development.

Carleton is very active in the Washington area IT community. He is a past president of the Capital Area Chapter of the Society for Information Management (www.simnet.org), and has a history of commitment to staff development. "One thing I do is facilitate a regional leadership development forum that targets emerging IT leaders and focuses on skills development outside of the usual technology area, such as organizational change and business strategy."

With master's degrees in Public Administration from Northeastern University and Information Resources Management from Syracuse University and a bachelor's degree from Boston University, Mike Carleton has a special commitment to leadership training and education. He teaches IT strategy at American University's Kogod Graduate School of Business, and is a frequent speaker at the National Defense University, Information Resources Management College, of which he is also a graduate. He is currently vice president for professional development on the Board of the American Council for Technology, and an active participant in ACT's mentoring programs.

He continues to find learning experiences everywhere. On a recent trip to the soccer World Cup, a 50th birthday present from his wife Jeuli Bartenstein, "it was interesting to observe the effects of web-based electronic commerce technologies on the distribution of World Cup tickets," he said. "They did it in a manner that combated counterfeiting and scalping, while improving equity of access and enabling conditional ticket sales. So fewer folks had to deal with untrusted parties and more folks got to see their favorite teams play."

As for the superb standard of play at the World Cup, Carleton offered the observation that "soccer players' skills seem to decline with age in all phases of the game except for the road trip and party, where they continue to improve with practice."

OMB has released a pilot version of its Federal Transition Framework (FTF), which will provide a single source for clear and consistent information describing government-wide IT policy objectives and cross-agency initiatives, such as the E-Gov and Lines of Business initiatives.

The FTF is a catalog of architectural information and implementation guidance for cross-agency initiatives using a simple and familiar structure that is aligned with the Federal Enterprise Architecture. It consists of a usage guide, a catalog and a metamodel reference guide.

OMB will be working with these initiatives and Federal agencies during the summer to complete version 1.0 of the FTF Catalog for release in September.

The pilot version catalogs three cross-agency initiatives: E-Authentication service, IPv6 transition, and the Infrastructure Optimization Initiative. OMB will add another 14 government-wide initiatives and feedback on the pilot to the next version.

The release of the pilot was announced in a July 6 memo to agency CIOs and chief architects from Karen Evans, OMB Administrator for E-Government and IT. Federal Enterprise Architect Richard Burk held an industry briefing on the pilot version July 13.

The FTF accelerates the ability of agencies to execute cross-agency initiatives and realize results faster. It will allow agencies to:

• Receive more consistent, complete and detailed information about cross-agency initiatives more quickly to inform their enterprise architecture, capital planning and implementation activities;
• Use information describing cross-agency initiatives to make better informed decisions about their IT investments; and
• Improve the effectiveness and efficiency of IT investments to realize service improvements and cost savings.

The real future for the FTF depends on connecting enterprise architecture to actual operations, according to industry expert Ed Seidewitz, vice president of Data Access Technologies, who was quoted by Federal Computer Week.

Given numerous recent reports of potential violations of sensitive personal information held by various Federal agencies, OMB has tightened its requirements for security-breach notification and for safeguarding information assets.

In a July 12 memo, OMB revised its guidance on reporting security incidents to require agencies "to report all incidents involving personally identifiable information to US-CERT within one hour of discovering the incident." US-CERT is a Federal incident response center in the Department of Homeland Security, which will forward all agency reports to the appropriate Identity Theft Task Force point-of-contact.

"You should report all incidents involving personally identifiable information in electronic or physical form and should not distinguish between suspected and confirmed breaches," the memo states.

The directive updates earlier OMB guidance on agency compliance with the Federal Information Security Management Act of 2002 (FISMA).

Earlier, in a June 23 memo, Clay Johnson III, OMB Deputy Director for Management, called on all agencies to properly safeguard their information assets using a checklist developed by the National Institute for Standards and Technology (NIST) to protect "remote information." He also recommended that agencies implement four additional safeguards within 45 days.

The NIST checklist directs agencies to take specific actions to protect Personally Identifiable Information (PII) categorized under the Federal Information Processing Standards (FIPS) Standard 199 as moderate or high impact that is either accessed remotely or physically transported outside of the agency's secured physical perimeter. It calls for agencies to follow four steps:

• Confirm identification of personally identifiable information protection needs.
• Verify adequacy of organizational policy.
• Implement protections for personally identifiable information being transported and/or stored offsite.
• Implement protections for remote access to personally identifiable information.

In addition to using the NIST checklist, Johnson recommended all departments and agencies take the following actions:

• Encrypt all data on mobile computers/devices which carry agency data unless the data is determined to be non-sensitive, in writing, by [the] Deputy Secretary or an individual he/she may designate in writing;
• Allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access;
• Use a "time-out" function for remote access and mobile devices requiring user re-authentication after 30 minutes inactivity; and
• Log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required.

Johnson said he intends to work with Federal inspectors general to ensure these safeguards have been reviewed and are in place in all agencies by August 7.

OMB issued FY 2006 reporting instructions for the Federal Information Security Management Act (FISMA) and for agencies' privacy management programs in a July 17 memo from Deputy Director for Management Clay Johnson III. The instructions require agencies to resolve any differences among contributors and not include conflicting views in the final version submitted to OMB.

The FISMA reporting categories and questions are the same as last year, but Johnson stressed that agencies are required to take several additional actions:

• Including with their FISMA reports, the results of their reviews responding to Johnson's May 22 memo on " Safeguarding Personally Identifiable Information."
• Providing a list of any systems the agency inspectors general found missing from the agencies' inventory of major information systems.
• Submitting agency privacy updates quarterly with security updates on the first day of September, December, March and June.
• Identifying any physical or electronic incidents involving the loss of or unauthorized access to personally identifiable information and reporting them in accordance with the OMB memo, "Reporting Incidents Involving Personally Identifiable Information and Incorporating the Cost for Security in Agency Information Technology Investments."

The report is due to OMB by October 1.

The U.S. Government Accountability Office (GAO) is calling on OMB to establish a structured, consistent process to designate and oversee high-risk IT projects and to direct agencies to consistently apply OMB's criteria for identifying them.

GAO issued its recommendations in a June 2006 report that examined the response to OMB's August 2005 memo directing agencies to identify high-risk IT projects and provide quarterly reports on those with performance shortfalls. In response to the memo, 24 major agencies identified 226 IT projects as high-risk. The projects account for about $6.4 billion in funding requested for fiscal year 2007.

Using OMB's criteria, agencies identified IT projects as high-risk based on these criteria:

• 154 projects were identified because their delay or failure would impact the agencies' essential business functions;
• 51 were identified because the projects had exceptionally high development, operating or maintenance costs;
• 35 were listed because the projects were addressing deficiencies in the agencies' ability to perform mission-critical business functions; and
• 11 were flagged because the agency has not consistently demonstrated the ability to manage complex projects.

Thirty-one projects were identified as high-risk using rationale other than OMB's four criteria.

High-risk projects and those on OMB's Management Watch List (projects that need improvements associated with aspects of their budget justifications) "require attention because of their importance in supporting critical functions and the likelihood that their performance problems could potentially result in billions of taxpayers' dollars being wasted if the problems are not detected early," the report states.

As Federal agencies strive to meet OMB's October 27 deadline for agencies to begin to issue secure personal identity verification cards for new employees and contractors under Homeland Security Presidential Directive-12 (HSPD-12), several developments intended to spur compliance have been announced.

As part of its mission to provide safe and secure design, production, distribution and management of secure documents for the Federal government, GPO will provide Personal Identity Verification (PIV) cards for Federal agencies as an alternative to in-house ID card personalization or the exclusive use of commercial sources.

• OMB issued a memo June 30 providing guidance on the acquisition of products and services for implementation of HSPD-12 that includes a list of certified products and services agencies can acquire to manage the new cards.
• The memo also gives Federal agencies a deadline of August 30 to inform the GSA Federal Acquisition Service if they are interested in assisted services to comply with HSPD-12. Agencies are asked to sign an interagency agreement with FAS by August 30 in order to participate in the shared solution. Agencies have until September 22 to sign an agreement for assistance in buying products.
• GSA has amended its request for proposals for vendors to establish up to 60 enrollment stations per month in Federal buildings around the country. The RFP was issued in conjunction with the Department of Agriculture. The HSPD-12 Implementation team expects that about 450 enrollment stations-300 fixed and 150 mobile-will be needed from January to October 2007 to meet the President's mandate to issue new high-tech identity cards for Federal employees and contractors beginning this year. The initial deployment will be in Federal buildings in Atlanta, Seattle, New York City and Washington, DC.
• Michael P. Butler, chief of the Department of Defense's smart-card programs, has gone to GSA on a six-month detail to help implement HSPD-12 in the rest of the government. He is focusing on getting HSPD-12 operations up and running to meet the October 27 deadline. Butler also chairs the Government Smart Card Interagency Advisory Board.
• He will be working closely with GSA's Judith Spencer, chair of the Federal Identity Credentialing Committee, who has been developing the architecture and requirements, and with David Temoshok, Identity Management director, who is leading the effort to identify approved products and services required to implement HSPD-12 and get them on the GSA schedule.

The Organization for the Advancement of Structured Information Standards (OASIS), a de facto international standards body, has ratified a new open IT standard for facilitating data-sharing across local, regional, national and international governments and organizations.

The new standard, called the Emergency Data Exchange Language Distribution Element (EDXL-DE) Version 1.0, acts as a header to identify to whom and under what circumstances emergency information is being sent. EDXL-DE will also address resource questions and requests, situation reports, damage assessments and other functionality issues for cross-jurisdictional emergency communications.

It was developed by the OASIS Emergency Management Technical Committee, with strong support and assistance from the U.S. Department of Homeland Security. In announcing the new standard on June 20, OASIS quoted Chip Hines, Acting Director of the DHS Office for Interoperability and Compatibility, as saying that "EDXL-DE will facilitate the implementation of a host of standards which will lead to fully interoperable sharing of information in emergency related applications. The ability of this standard to transmit any content, from files to technical data exchange information, provides immediate capability to the emergency response community."

The National Governors Association (NGA) Center for Best Practices has awarded $25,000 grants to six states to help them share critical public safety information among law enforcement, courts and corrections systems.

The grants, which are funded by the Justice Department's Office of Justice Programs, Bureau of Justice Assistance, support information-sharing projects that can be used to design an operational system or process, convene a task force to develop an implementation plan or add to existing funding for implementation.

The states will use the grants to complete the following projects by January 2007:

• Alabama will conduct a pilot program to demonstrate the interstate sharing of critical justice-related information such as court, corrections and parole records, as well as driver's license and car registration records.
• The Delaware Information Analysis Center will procure additional analysis tools to enhance its homeland security functions.
• Illinois will attempt to identify privacy issues created by the enhanced collection, analysis and sharing of electronic police incident report information.
• Michigan State Police will upgrade its Statewide Network of Agency Photos-a database of criminal mug shots-by updating the software to permit digital images.
• South Carolina Information Exchange will create a standardized search function for telephone numbers that enables users to find everyone who has been associated with a specific telephone number.
• The Wisconsin Justice Information Sharing program will develop standard language to help ensure privacy protections throughout the integrated justice system.

A recent NGA issues brief, Protecting Privacy in Integrated Justice Systems, offered recommendations to help states continue the public safety gains made by information sharing while improving individual privacy protections.

New York City, representing all large cities in the United States, was the second-highest ranked city in a study of digital governance in cities around the world. Seoul, South Korea, ranked highest, with other Far-Eastern cities dominating the 10 top-ranked cities.

The study evaluated each city's website in terms of digital governance, including both digital government (delivery of public service) and digital democracy (citizen participation in governance).

The research used an e-governance performance index to evaluate e-governance in Hong Kong, Macao, and the most populated cities in 98 countries. Cities were ranked in five areas: "Security and Privacy," "Usability," "Content," "Service," and "Citizen Participation." Seoul scored highest in all categories except "Usability," where New York City topped the list. The 10 highest scoring cities were:

• Seoul, South Korea
• New York City
• Shanghai, China
• Hong Kong
• Sydney, Australia
• Singapore
• Tokyo, Japan
• Zurich, Switzerland
• Toronto, Canada
• Riga, Latvia.

The survey, Digital Governance in Municipalities Worldwide - 2005, was conducted by the E-Governance Institute of Rutgers University-Newark and the Global e-Policy e-Government Institute of the Graduate School of Governance, Sungkyunkwan University, Korea. It was co-sponsored by the United Nations Division of Public Administration and Development Management and the American Society for Public Administration.

The U.S. Postal Service (USPS), Miami-Dade, FL, and Fairfax County, VA, are the only three government organizations listed in Computerworld magazine's 13th annual ranking of "100 Best Places to Work in IT 2006," published June 19.

The selection of the top 100 best places to work in IT was based on a 100-question survey sent to contacts in companies headquartered in the United States that submitted nominations last August. To qualify, the participants-both public and private-had to have 2005 revenues totaling $250 million or more. They also had to employ at least 500 employees, of whom at least 75 had to work in IT in the U.S.

The survey asked about the organizations' average salary and bonus increases, the percentage of IT employees receiving promotions, IT staff turnover rates, training and development opportunities and the percentage of women and minorities in IT staff and management positions. Information was also collected on rewards for outstanding performance, how retention programs are structured and the benefits offered-ranging from elder and child care to flextime and tuition reimbursement.

Of the public-sector organizations on the list, USPS ranked 48th; Miami-Dade ranked 76th and Fairfax County ranked 98th.

The top five organizations were, in order: Quicken Loans, Inc, the University of Miami, The Capital Group Companies, American Fidelity Assurance Company, and Grant Thornton LLP.

Innovations in American Government Awards Two Federal programs, two State, one county and two city government programs were presented with prestigious Innovations in American Government Awards July 10.

The awards, which include $100,000 in prize money, are given to government programs that can demonstrate they are truly creative, measurably effective, meet a significant need and can be transferred successfully to other jurisdictions. This year's seven winners were selected from 18 finalists out of more than 1,000 applicants.

The Innovations in American Government Awards, created in 1986, are presented annually by the Ash Institute for Democratic Governance and Innovation at Harvard University's John F. Kennedy School of Government. The awards are administered in partnership with the Council for Excellence in Government.

FirstGov.gov was an Innovations Award winner in 2003; OMB's Program Assessment Rating Tool (PART) won in 2005.

The 2006 winners are:

• Grass Roots Conservation Program, U.S. Fish and Wildlife Service
• Health Information Technology, U.S. Department of Veterans Affairs (VistA)
• Supportive Housing Pilots Initiative, State of Connecticut
• Teaming (a groundbreaking child welfare practice), Commonwealth of Massachusetts
• Urban Academies Program, School Board of Broward County, FL
• Gay and Lesbian Liaison Unit, Washington, DC, Metropolitan Police Department


• Mayor's Charter Schools Initiative, Indianapolis, IN.

Each winner's presentation can be viewed on the Ash Institute's website.

Federal Computer Week Pioneer Awards Nine projects that have demonstrated "innovative use of technology in government programs," through either commercial-off-the-shelf (COTS) solutions or other technology applications, have been named winners of Federal Computer Week's Pioneer Awards.

The winners are:

• Clinical Information Technology Program Office (CITPO); AHLTA, the Military Electronic Health Record (EHR) (Office of the Assistant Secretary of Defense, Health Affairs)
• Environmental Protection Agency (EPA) Office of Environmental Information; Enterprise Customer Service Solution (ECSS)
• General Services Administration (GSA); FirstGov Search
• Internet Development Services, Electronic Tax Administration, Internal Revenue Service (IRS); IRS.gov Web Site Redesign
• Joint Medical Information Office; Theatre Medical Information Program (TMIP) (Office of the Assistant Secretary of Defense, Health Affairs)
• Kansas Highway Patrol; Online Crash Logs
• Maine State Police; Crash Reporting Search and Ordering Service
• Social Security Administration, Office of the Chief Administrative Law Judge, Video Hearing Project.

The U.S. Postal Service was the winner of the 2006 Successful Public/Private Sector Partnership Award for the USPS Hurricane Reports.

The awards will be presented at a luncheon at the itsGov Technology Showcase 2006 on July 26, where the winners will demonstrate their innovative projects.

Also available in pdf 636 kb

GSA Assistive Technology Showcase
Washington, DC
July 26

itsGov Technology Buying at Year-End Showcase
Washington, DC
July 26

National Association of Counties (NACo) Annual Conference
Cook County, IL
August 4-6

Western Information Technology Council
Stateline, NV
August 6-9

Expedition Workshop: Networking Semantic Interoperability
Arlington, VA
August 15

International City/County Management Association Conference
San Antonio, TX
September 10-13

National Association of Government Webmasters Conference
Reno, NV
September 27-29

National Association of State CIOs (NASCIO) Annual Conference
Miami, FL
October 15-18

Executive Leadership Conference
Williamsburg, VA
October 29-31

FCW Government CIO Summit
San Diego, CA
November 5-7

National Electronic Commerce Coordinating Council Annual Conference
Sacramento, CA
December 4-6

Comments: We welcome your feedback.

Please send your comments, concerns, complaints and questions to dotgovbuzz@gsa.gov.

Check out our previous editions at www.firstgov.gov/dotgovbuzz.html.

The DotGov Buzz is produced by the following individuals in the GSA Office of Citizen Services and Communications:

Darlene Meskell
Ted Cogdell
Bryant Jones
Ernestine Ramsay.