Reporter’s Notebook

jason-miller-original“Reporter’s Notebook” is a weekly dispatch of news tidbits, strongly-sourced buzz, and other items of interest happening in the federal IT and acquisition communities.

Submit ideas, suggestions and news tips  to Jason via email.

 Sign up for our Reporter’s Notebook email alert.

Additional tools are good, but contracting officers need OFPP cover

There’s an old saying among acquisition professionals that unless the FAR says you can’t do it, then you can. What happens many times, however, is the opposite and that stops contracting officers from being innovative.

As part of its effort to bring innovation into the federal procurement process, especially around technology, the White House added another tool to the toolbox to help change the federal culture.

The Office of Federal Procurement Policy and the Office of Science and Technology Policy released a story book of acquisition innovations.

The Innovative Contracting Case Studies is “an iterative, evolving document that describes a number of ways federal agencies are getting more innovation per taxpayer dollar — all under existing laws and regulations,” wrote Lesley Field, deputy administrator of OFPP, and Tom Kalil, deputy director for Technology and Innovation in OSTP Thursday in a blog post.

Along with the case studies, OFPP set up a government-only email group, called the Buyer’s Club, to “provide a useful forum for troubleshooting and sharing best practices across the federal government, serving everyone from contracting officers with deep expertise in the Federal Acquisition Regulation (FAR) to program managers looking for new ways to achieve their agencies’ missions.”

In the 91-page document, OFPP and OSTP describe eight different approaches to innovative acquisition processes. Some, such as prizes and competitions, are relatively new to government, while others, such as milestone-based competitions, have been around for a long time, but mostly underutilized by agencies.

While a document such as this makes sense, it’s far from what’s needed.

What OFPP needs to do is provide top cover for agencies when inspectors general, the Government Accountability Office and, especially, Congress come knocking at their door. Over the last five or so years, acquisition professionals have come under more and more scrutiny from auditors, which is causing them to be more conservative.

The White House needs to help traditionally risk-averse contracting officers feel comfortable in doing something different. OFPP’s backing would begin to create the change that many of these new tools, such as the TechFAR or the case studies, are trying to kick-start.

This post is part of Jason Miller’s Inside the Reporter’s Notebook feature. Read more from this edition of Jason’s Notebook.


Role shifts for some GSA acquisition executives

Look out for some familiar faces in new positions in the General Services Administration’s Federal Acquisition Service.

Donna Jenkins is moving over to become the assistant commissioner for the Office of Acquisition Management from her role as director of the Federal Acquisition Institute. She’ll replace Houston Taylor, who’s putting on a new hat as the assistant commissioner for the Office of Customer Accounts and Research.

Tom Sharpe, FAS commissioner, announced the seat shuffling takes effect Aug. 24 in a memo to staff, which Federal News Radio obtained.

Sharpe said Taylor “will focus on enhancing the agency’s work to communicate and share our value proposition with customers, the collection and use of customer data and our customer relationship and account management functions.”

Jenkins has led FAI for about four years and previously served as the director of DHS’ acquisition workforce.

Sharpe said Jenkins will “focus on improving and expanding GSA’s relationships in our supplier community, modernizing and streamlining the Multiple Award Schedules program and providing training to our GSA workforce, agency customers and industry partners. She will also work on improving the quality of FAS contracts and strengthening our procurement controls across the agency.”

Additionally, Bill Sisk, FAS deputy commissioner, will take on a second hat and serve as the acting assistant commissioner for Office of Travel, Motor Vehicle, and Card Services. Bill Toth had been acting since Bill Webster retired in June.

There were a few other noteworthy changes among agency executives.

Tom Bayer, the Securities and Exchange Commission’s chief information officer, announced he’s leaving government in October.

Bayer said after four years it was time for a new challenge and time to bring in someone new to take the SEC IT to the next level.

“I thought it was good time to leave, as much of what I laid out from an enterprise architecture program and the SEC’s working smarter program has been executed,” Bayer said in an interview with Federal News Radio. “I feel really good about our progress. We saved $18.8 million last year in IT costs, and we’ve given our workforce more capabilities. I think that it’s good to renew the CIO position after a period of years.”

Bayer said he would expect deputy CIO Pam Dyson to step into the acting role when he departs in October.

He said he hasn’t started looking for a new job yet because of SEC conflict of interest rules.

Over at the Department of Health and Human Services, Kevin Charest left his position as the chief information security officer in May. Charest spent about seven years in government, including the last 20 months as the HHS CISO.

Charest now is the senior director of IT threat management in the Information Risk Management group for the UnitedHealth Group, according to his LinkedIn page.

During his time at HHS, Charest focused on improving HHS cybersecurity, in part, by using big data. He said in September that the creation of a security operations center (SOC) as a central coordination place to bring together threat data from across the agency is making a big difference.

This post is part of Jason Miller’s Inside the Reporter’s Notebook feature. Read more from this edition of Jason’s Notebook.


The EAGLE (2) has landed, softly

On your mark, get set — it’s go time for the most sought after part of the Homeland Security Department’s EAGLE II technology services contract.

DHS quietly has been telling the 60-plus vendors that functional category one is open for business. Industry and government sources say DHS wanted to do a soft launch since EAGLE II faced a host of delays and protests over the last three years.

Functional category-1 is the biggest of the four EAGLE focus areas. It includes system design, development, implementation and integration, software design and development, operations and maintenance, such as help desk, collaboration services and network and security operations.

DHS has struggled to get the $22 billion EAGLE II contract in place. They still face protests from small businesses under functional category 2 — IT program support services.

Vendors have long seen EAGLE as one of the largest avenues into DHS. As of fiscal 2011 — the last year DHS provides data — Homeland Security components spent more than $11.4 billion on 606 task orders over the five-year period.

The winning contractors should expect little change in how DHS buys IT over the next five years, which is why EAGLE II took nearly three years to award.

DHS already lists 23 potential procurements scheduled to go through EAGLE II on its procurement forecast website. These range from the Citizen and Immigration Service’s joint engineering teams-sustainment (JETS) program that could be worth $100 million to $10 billion, to FEMA’s $10 million to $20 million program under the Disaster Management e-government initiative.

Of course, most vendors are watching what DHS does with its Next Generation Enterprise Computing Services (ECS) program. Basically, it’s the follow-on contract to running one of two DHS data centers.

Sources say DHS is sifting through RFI responses to develop its solicitation strategy.

Two other big opportunities that are coming from DHS are FEMA’s Enterprise Applications Development Integration and Sustainment (EADIS) that could be worth about $1 billion, and follow-on to its Centralized Operations, Maintenance and Management Information Technology (COMMIT) acquisition.

Sources say both could go through EAGLE II, so the fact that FC-1 is open for business, let the fun begin.

This post is part of Jason Miller’s Inside the Reporter’s Notebook feature. Read more from this edition of Jason’s Notebook.


Agencies losing faith in prices on GSA schedules?

A growing number of agencies no longer believe prices under the General Services Administration schedules program are “fair and reasonable.”

Along with the Defense Department, NASA quietly issued a memo in March that requires its contracting officers to do additional research to ensure GSA schedule prices are the best value for the government. Industry sources say other agency memos could follow from the likes of the departments of Health and Human Services, Homeland Security and Energy.

And nearly five months after the Defense Department’s Dick Ginman, director for procurement and acquisition policy (DPAP), created quite a stir by changing almost two decades of precedent around GSA schedule prices, Tom Sharpe, the commissioner of the Federal Acquisition Service, finally responded publicly to these major changes.

“I support what Dick Ginman has done in terms of telling his contracting workforce to go ahead and apply techniques to get the best price, value and other things important to the taxpayers when they raise orders or otherwise contract — that means getting competition and that means negotiating prices,” Sharpe said in an interview with Federal News Radio. “I think where Dick was at, and I agree with him, is we didn’t know how often contracting officers were receiving discounts. If you have any type of large volume at the order level, you should in fact be competing orders and negotiating discounts. The schedules were set up to enable that.”

Sharpe said by standardizing part numbers and descriptions on the schedules, GSA will use the data to make decisions about how much price variability in the schedules make sense, and agencies can use the data to make better buying decisions. He said GSA also plans to propose a rule to require schedule contractors to provide prices paid data and all demographics around it.

Sharpe said FAS will put that data in a tool so buyers can use it to help them shape how they should price that order.

“I support the agencies getting the best prices they can,” he said. “I’m in the process at FAS of setting the conditions, particularly on the multiple award schedule, such that possibly those deviations would no longer be needed, and I’ll defer to those customers.”

Despite Sharpe’s support of DoD, and presumably NASA too, industry experts aren’t happy with this growing trend. Several sources say DoD, and now NASA, aren’t solving a problem with the schedules, but rather not addressing a problem with the training of contracting officers.

Bill McNally, NASA’s assistant administrator for procurement, said like DoD, he believes contract prices under the individual schedule contract aren’t necessarily “fair and reasonable” to the agency at the task or delivery order level.

“This is an example of different agencies who talk to each other and both believe that what they will do is the best thing for their agency,” McNally said in an interview with Federal News Radio. “It’s a shared practice, what DoD and NASA are doing. It’s based on my conversations with my staff and I have had with Dick and his staff, which I think we should be doing more and more in the federal government.”

He added he believes NASA contracting officers were ensuring they were getting the best prices when using GSA schedules, but the memo just codified the requirement.

“You should be going out and looking at multiple sources. You should be making sure there is adequate price competition when you sign a task order and that you got a fair and reasonable price,” McNally said. “You have to make sure they do all analysis that’s within FAR part 15 when price cost analysis, that is done to determine that task order or delivery order.”

NASA spends about $100 million a year through the GSA schedules.

Some sources say now that DoD and NASA have issued deviations — two of the three Federal Acquisition Regulations Council signatories — it’s only a matter of time until the FAR Council gets involved. GSA is the third signatory.

McNally said as a signatory of the FAR Council, he and others look out for what’s in the best interest of the government, not of NASA.

McNally said the idea of GSA schedule prices being fair and reasonable has come up at the Chief Acquisition Officer’s Council meetings.

At the same time, if two of the largest agencies believe the schedules are no longer “fair and reasonable,” and if other big spending agencies join them, don’t be surprised if a major FAR change isn’t far behind.

This post is part of Jason Miller’s Inside the Reporter’s Notebook feature. Read more from this edition of Jason’s Notebook.


Inside the Reporter’s Notebook: Swinging exit doors at VA, DHS, GSA; Procurement fun at HHS

“Inside the Reporter’s Notebook” is a biweekly dispatch of news and information you may have missed or that slipped through the cracks at conferences, hearings and the like.

This is not a column nor commentary — it’s news tidbits, strongly sourced buzz, and other items of interest that have happened or are happening in the federal IT and acquisition communities.

As always, I encourage you to submit ideas, suggestions and, of course, news to me at jpmiller@federalnewsradio.com.

Be the first to know when a new Inside the Reporter’s Notebook is posted. Sign up today for our Inside the Reporter’s Notebook email alert.


VA IT office’s exit door swings open for two, maybe more

A huge wave of exits may be coming to the Veterans Affairs Department chief information officer’s office in the coming months.

The beginning of this swell already has begun with Charles De Sanno, VA’s executive director for Enterprise Technology and Infrastructure Engineering, and Stan Lowe, VA’s chief information security officer, heading out the door in the coming months.

Multiple sources confirm De Sanno is retiring and taking a position in the private sector. Sources say De Sanno wouldn’t say where he was going just yet, but he’s likely leaving at the end of August.

Sources say Lowe also is heading to the private sector, leaving VA as early as September.

Additionally, there are possibly two or three other senior executives looking to leave VA in the coming months.

A VA spokeswoman couldn’t confirm the De Sanno and Lowe’s impending departures.

“VA lawyers have told VA they cannot confirm departures of any employees’ intentions to leave and can only acknowledge departures after the employees are gone,” said a VA spokeswoman. “All those you mentioned are still working in OIT.”

The potential mass exodus from VA’s Office of Information Technology isn’t surprising given two recent developments.

The first is the continued pressure on VA by the House Veterans Affairs Committee over its IT and cybersecurity woes. The committee planned a cyber hearing in July, but postponed it. Sources say it will be rescheduled for September most likely.

The second reason is the new leadership at VA. Secretary Robert McDonald officially came on board July 30 and Deputy Secretary Sloan Gibson has been in place only since February.

The loss of De Sanno and Lowe comes as Lorraine Landfried, VA’s deputy CIO for product development, resigned in July.

Lowe came to VA in October 2010 and assumed the CISO role in January 2013.

De Sanno has been with VA for 25 years. As the executive director for Enterprise Technology and Infrastructure Engineering, De Sanno directs the enterprise technology engineering efforts for systems solutions across the department.


GSA loss is DoT’s gain

A big move in the federal cloud computing world is about to happen. Multiple industry sources confirm that Maria Roat is likely headed to the Transportation Department to be its chief technology officer.

Sources say all that’s left is the official paperwork to be completed, but as one industry source said, “It’s been an open secret for a few weeks now.”

Roat has been the director of the Federal Risk Management and Authorization program at the General Services Administration since January 2013. She has been a driving force behind the cloud cybersecurity program and moving it from the initial operating capability to full operational capability.

Matt Goodrich likely will be Roat’s interim replacement, and another industry source said he is the leading candidate to be the full-time FedRAMP director.

Once the move is finalized, Roat would manage the business technology and governance and technology strategy and modernization activities of the department, according to the job posting on USAJobs.gov.

Roat also would lead the Technology Control Board (TCB), which is made up of IT representatives from all of the DoT’s bureaus. The control board ensures the agency implements technology that meets DoT standards, architecture and shared services mandates.

Before coming to GSA, Roat was the deputy CIO at FEMA and served as chief of staff in the DHS Office of the Chief Information Officer.


Another DHS cyber executive heading to private sector

The Homeland Security Department also is facing a similar set of senior executive departures as VA.

Jenny Menna, DHS’ director of stakeholder engagement and cyber infrastructure resilience (SECIR), joins Larry Zelvin as the latest to head to the private sector.

Andy Ozment, the assistant secretary for cybersecurity and communications, wrote in a note to staff that Menna’s last day will be Aug. 15.

“Jenny has done an outstanding job building a broad security partnership between DHS and the private sector. Her many accomplishments during her tenure at SECIR include standing up the Enhanced Cybersecurity Services (ECS) program, expanding the Cyber Information Sharing and Collaboration Program (CISCP), implementing the Critical Infrastructure Cyber Community C³ Voluntary Program in support of the NIST Cybersecurity Framework, and significantly increasing engagement with state, local, tribal and territorial governments,” Ozment wrote in the email obtained by Federal News Radio. “Perhaps her greatest accomplishment, though, is SECIR itself. She has built an extremely strong organization that the broader CS&C, NPPD, and Department rely upon. Jenny, and the team at SECIR, should be proud of what they have done together.”

Ozment said Bobbie Stempfley, deputy assistant secretary for Cybersecurity Strategy and Emergency Communications, will take over for Menna in the interim.

A lot of Menna’s time and effort over the last year has been overseeing the development of DHS’ piece of President Barack Obama’s cyber executive order from February 2013.

House lawmakers recently passed a bill that would codify DHS’ communications and collaboration with critical infrastructure providers, provide liability protection for the sharing of cyber threats and attacks, and further establish SECIR’s role in working with industry.

Along with DHS’ Menna, there have been a few other noteworthy changes.

Jeff Press, the Performance Improvement Council’s senior advisor, is moving on to bigger and better things. He’s taken a job as the Department of Commerce as the deputy director of Performance Strategy.

Press has been with the PIC since September 2010 and has helped promote the PIC and its role in helping agencies improve how they use data to make decisions.

Another big move on the industry side is Diana Gowen retired as CenturyLink Government’s senior vice president and general manager on June 30.

Gowen joined Deep Water Point as a principal consultant working on IT and telecommunications issues.

“Diana has been a strong and effective leader during her nine years with CenturyLink,” said Linda Johnson, a spokeswoman for CenturyLink Government. “She and her team have been instrumental in establishing CenturyLink’s reputation as an industry-leading broadband, cybersecurity and IT services provider to the federal government. The company recognizes her excellent work on behalf of CenturyLink and our federal government customers, thanks her for her dedication, leadership and many contributions to the growth and success of our business over the years, and wishes her well on her retirement.”

Gowen has been an outspoken critic of the General Services Administration’s Networx telecommunications contract, and the challenges agencies have had in using it. She’s also been CenturyLink Government’s public face for the last nine years.


Summer procurement fun from HHS, VA

VA and the Department of Health and Human Services each issued procurements that should raise the excitement level in industry.

VA issued a request for information for the next generation of its technology multiple award contract known as T4.

Meanwhile, HHS released its first request for proposal under its Buyers Club initiative. The HHS Buyers Club is one of a growing number of approaches — think GSA 18F or the Office of Management and Budget’s proposed Digital Services office — to bring innovation into the government more quickly and more successfully.

Both procurements are going to attract industry’s attention and other agency’s interest.

VA awarded T4 in June 2011 to nine large businesses and six small firms to provide IT products and services under a five-year, $12 billion deal. T4 expires in June 2016 so the RFI is VA’s first step toward getting the follow-on contract in place in the next year.

Under the draft performance statement of work, VA stated T4 next generation would be for five years with a five-year option. It covers more than three dozen functional and sub-functional areas ranging from program management, strategy, enterprise architecture and planning support to systems/software engineering to IT service management implementation to enterprise application/services.

Responses to the RFI are due Aug. 28

This proposed follow-on to T4 will be a good test of the Office of Federal Procurement Policy’s requirement for agencies to submit a business case for new multiple award contracts. Little is known about how OFPP’s process is working or what effect it is having on agency decisions to launch multiple award contracts. OFPP’s Interagency Contract Directory lists almost 4,000 multiple award contracts for IT and telecommunication services.

VA has spent more than $1.5 billion under T4 in 2013, according to data from the Federal Procurement Data System compiled by KRT Associates.

Over at HHS, the Office of the Assistant Secretary for Planning and Evaluation released an RFP for a vendor to:

  • Implement a platform and technical infrastructure supporting ASPE websites, databases and software development environments;
  • Implement a Web content management system and software package similar to SharePoint Foundation or Drupal with a strong preference for open-source;
  • Redesign ASPE’s public website and intranet website;
  • Migrate these websites and associated databases to an open source Web content management system; and
  • Modernize two database applications.

HHS is dividing the procurement into four phases all focused on agile development processes.

This procurement is different than others, according to a tweet by HHS CTO Bryan Sivak, is because the agency is paying for a prototype. The two-stage source selection process means vendors have two weeks to submit a proposal. Then, HHS will evaluate bids and select as many as five firms to received $10,000 to create a prototype in three weeks. Finally, HHS will pick one vendor based on their prototype and presentation for the award.

“The down-select process will enable contractors an opportunity to showcase their abilities and expertise by delivering a short-term, functional prototype in support of their proposed concept rather than a detailed paper-based proposal. This proof-of-concept approach is consistent with private sector methodologies,” HHS wrote in the RFP. “The Technical Evaluation Panel [will get] an opportunity to see functional prototypes before an award is made, ensuring that a contractor has the ability and expertise required.”

HHS also stated that the two-step process will streamline the initial competition and let vendors focus on their core competencies rather than drafting lengthy responses to a solicitation.

It will be interesting to see how industry reacts and HHS evaluates the bids. A successful protest could spell trouble for these efforts to change the federal procurement process. At the same time, if HHS doesn’t get the reaction from industry it hopes for, that too could impact future plans for these types of pilots.

The Buyers Club is one of several innovation initiatives industry and Congress are closely watching.

Responses to the RFP are due Aug. 19


Agencies fail email cyber tests

Federal agencies are not adopting industry best practices for securing their email systems.

Even with the move to the cloud, the Online Trust Alliance, a non-profit organization that focuses on enhancing trust and user empowerment of the Web, found only the House of Representatives and the Senate received passing grades when it comes to email cybersecurity.

OTA looked at the adoption of three critical email authentication standards across the top 50 federal websites, the top 100 FDIC insured banks, the top 500 Internet retailers, the top 50 social media sites and the top 50 news or media sites.

“By implementing email authentication, organizations can help protect their brands and consumers from receiving spoofed and forged email,” OTA said in the report. “There has been growth in the deployment of email authentication in all industry sectors, yet major and systemic issues remain. The failure to apply authentication standards comprehensively risks placing consumers and employees in harm’s way. This is often the result of companies authenticating only selected sub-domains and failing to authenticate their top level domain which is the domain most often abused. The inconsistent use of authentication is like reinforcing and locking the front door to your house, while leaving your side door or garage doors wide open.”

Among the Fed 50, OTA found only 4 percent adopted email authentication best practices, such as Domain Keys Identified Mail and not publishing their Domain- based Message Authentication, Reporting and Conformance records.

OTA recommended adopting email authentication across all channels and domains. It said implementing inbound email authentication to protect employees and corporate data from spear phishing is important too.

IT Job of the Week What a challenge this job would be: the chief information security and senior privacy officer for the Centers for Medicaid and Medicare Services. One of the most customer focused and citizen centric organizations in government. CMS holds the personal data of hundreds of millions of Americans, and it would be your job to protect that information. The CISO/CPO would provide expert advice and collaborate with CMS’ organizations in developing, promoting and maintaining IT security and privacy measures to protect sensitive information. Applications are due by Aug. 31.

MORE INSIDE THE REPORTER’S NOTEBOOK:

Inside the Reporter’s Notebook: Category management launches five pilots; more vendor past performance data

Inside the Reporter’s Notebook: FedRAMP compliance results months away, OMB’s word of the year: Effectiveness


Inside the Reporter’s Notebook: Category management launches five pilots; more vendor past performance data

“Inside the Reporter’s Notebook” is a biweekly dispatch of news and information you may have missed or that slipped through the cracks at conferences, hearings and the like.

This is not a column nor commentary — it’s news tidbits, strongly sourced buzz, and other items of interest that have happened or are happening in the federal IT and acquisition communities.

As always, I encourage you to submit ideas, suggestions and, of course, news to me at jpmiller@federalnewsradio.com.


Category management launches five pilots

The category management initiative led by the General Services Administration is starting to come into focus. GSA kicked off five governmentwide pilots and 17 agency specific functional areas.

GSA detailed the five pilots at the June Chief Acquisition Officer’s Council. Multiple sources confirmed the five pilots are:

  • Information Technology-led by Mary Davie, GSA’s assistant commissioner for the Office of Integrated Technology Services (ITS). This pilot will focus on hardware, software, telecommunications and services.
  • Human capital-led by Sydney Smith-Heimbrock, who leads the employee services’ center for strategic workforce planning for the Office of Personnel Management. The acquisition piece of the upcoming training and management assistance (TMA) contract will be a major part of this effort, sources say.
  • Administration–Marty Jennings, GSA’s assistant commissioner of General Supplies and Services, will head up this effort that includes areas such as office supplies.
  • Transportation–The Defense Department Transportation Command will lead this effort, which includes the next generation of delivery services under the strategic sourcing initiative.
  • Medical and pharmaceutical supplies – Sources say GSA hasn’t named someone to lead the pilot yet. It will focus on surgical and medical supplies.

“It’s a smart way to approach commodity buying and evaluating where agencies are spending their money and how to maximize value from that spend,” said Alan Chvotkin, senior vice president and general counsel for the Professional Services Council, an industry association. “At its core, it looks like strategic sourcing, but the difference is it’s not looking at reducing the number of suppliers.”

Chvotkin said category management is just a new name for something government and industry have been doing for years. He pointed to the Freeze the Footprint initiative and the enterprise software license program called SmartBuy as two examples of where the government is trying to use data to better understand what and how they buy and then improve their outcomes.

Category management is part of GSA’s effort to enhance how it serves industry and agency customers.

Through category management, Federal Acquisition Service Commissioner Tom Sharpe said GSA can provide a more coordinated, strategic approach to governmentwide purchasing and more cost savings.

Sharpe said in the past that GSA hopes to increase its market share of federal procurement spending to as much as 66 percent from around 15 percent as of 2013.

But multiple sources confirmed that GSA’s talk about market share is rubbing some agencies the wrong way. Sources say Defense Department acquisition officials recently made it clear that GSA needs to stop talking and start doing.

Sources say if GSA wants to be a provider of choice, DoD officials told Sharpe and others at FAS that they need to work on specific solutions and not just talk about market share. And speaking of DoD, Sharpe and GSA haven’t publicly said word one about the April memo from Dick Ginman, director for procurement and acquisition policy, requiring contracting officers to make their own determinations about whether the prices on the GSA schedules are fair and reasonable.

Since Ginman issued the memo, DoD hasn’t acted to translate the memo into regulatory changes so it’s unclear what impact it’s actually having.

But GSA’s lack of public comment, some say, is disconcerting because instead of nipping the potential controversy in the bud, DoD’s concerns are taking root with other agencies.

Sources say the departments of Energy and Health and Human Services are working on similar memos. HHS and DoE are big users of the GSA schedules and if three of the largest users decide the schedule prices are not fair and reasonable as the Federal Acquisition Regulations say they are, that could be the start of big problems for GSA.


Quick to the Google for more vendor past performance data

Few took notice to the latest effort by the Office of Federal Procurement Policy to get agencies to make better use of past performance data.

Lesley Field, acting OFPP administrator, issued a memo July 10 requiring agencies to do more research and evaluation of vendor performance.

“To address this risk and ensure we make awards to contractors with good performance records, as well as to encourage the use of new and innovative companies with little or no Federal experience, agencies are directed to undertake additional outreach and research to make more informed decisions, as described below,” Field wrote in the memo. “These common sense steps are to be applied to, at a minimum, acquisitions (contracts or orders) for complex information technology (IT) development, systems, and services over $500,000, and other acquisitions (contracts or orders) identified by the agency as presenting a significant risk.”

This is the fourth memo since 2009 OFPP has sent out to agencies trying to get them to improve data quality and the use of past performance information to make better acquisition decisions. OFPP’s memo comes in light of stark criticism by Senate lawmakers on the quality of the data in the past performance database and the inability of agencies to make informed decisions.

Given those long-standing problems, Field told agencies to consider other sources of information beyond the Past Performance Information Retrieval System (PPIRS). These include everything from asking for feedback from other federal agencies to searching for news about the company to talking to subcontractors.

At the same time, however, OFPP smartly recognized that companies may need to respond to public data may be considered negative and offer information on how they resolved any problems.

Sen. Claire McCaskill (D-Mo.) has been the most outspoken critic of PPIRS and agency use of data. The memo seems to show the administration is listening, particularly around the technology behind PPIRS.

Field wrote that GSA updated the Integrated Award Environment (IAE) system in June to standardize contractor performance evaluations and reduce cost and duplication through the merger of two separate past performance modules into Contractor Performance Assessment Reporting System (CPARS). GSA also simplified the process for assessing contractor performance by standardizing the rating elements, using a single assessment form and establishing a standard workflow. Finally, it enhanced the system so that performance evaluations can be shared faster with source selection team.

Field said future CPARS improvements in 2015 include additional search functions, the ability to display all reports from one vendor and advanced reporting tools.

One interesting aside to this discussion on contractor past performance data, Anne Rung, the White House’s nominee to be OFPP administrator, wrote in her questions for the record to the Senate Homeland Security and Governmental Affairs Committee that she would look into whether vendors should rate agencies on their acquisition process.

That would certainly turn the tables on the idea of past performance as agency ratings might just be the missing motivator for real acquisition improvements.


Technology leaders on the move

The Defense Intelligence Agency is looking for a new chief information officer. The Energy Department is getting a new chief information security officer from the Commerce Department.

Grant Schneider decided after seven years as DIA CIO he’s ready for a new challenge.

A DIA spokesman said the current plan is for Schneider to remain at DIA until a new person is selected and is on board. The spokesperson said Schneider hasn’t announced any future plans. DIA’s job announcement for a CIO closed July 25.

Schneider was well-regarded as the DIA CIO where he focused on helping lead the Intelligence Community toward common technology and services under the Intelligence Community’s IT Enterprise program.

Meanwhile, Rod Turk, the chief information Security Officer at Commerce is heading to Energy in the same role. He will take over for Gil Vega, who left in August 2013.

Politico first reported Turk’s new job.

A Commerce spokesperson confirmed that Turk will join Energy next week, and Mike Maraya will be acting Commerce CISO. Maraya currently is the agency’s enterprise cybersecurity program manager within the Office of Cybersecurity.


IT Job of the Week

Both the DIA and Commerce CISO jobs would be the obvious highlights, but another interesting position caught my eye. The Homeland Security Department is looking for a chief technology officer.

DHS wants the CTO to “drive standardization of technologies, evolution of best practices and identification of technology trends and/or approaches that may support or impede the fulfillment of DHS mission through collaboration and knowledge sharing with and education of management, partners, customers, and stakeholders.”

Applications are due by Aug. 4.


Inside the Reporter’s Notebook: FedRAMP compliance results months away, OMB’s word of the year: Effectiveness

“Inside the Reporter’s Notebook” is a biweekly dispatch of news and information you may have missed or that slipped through the cracks at conferences, hearings and the like.

This is not a column nor commentary — it’s news tidbits, strongly sourced buzz, and other items of interest that have happened or are happening in the federal IT and acquisition communities.

As always, I encourage you to submit ideas, suggestions and, of course, news to me at jpmiller@federalnewsradio.com.


FedRAMP compliance results months away

Why fret over a deadline anyway? The government is filled with deadlines that few pay attention to. Heck, the Defense Department just issued a proposed rule that Congress called for in the Defense Authorization bill from 2008 — more on that later.

But the administration’s requirement for agencies only to use cloud services that have been approved through the Federal Risk Authorization Management Program (FedRAMP) starting June 5 will be one of those with long legs, playing out over the course of the summer.

First off, the Office of Management and Budget isn’t going agency-by-agency this week to check on compliance.

Instead, OMB will oversee how agencies met this goal through existing processes.

“The Office of Management and Budget will conduct oversight through PortfolioStat and other processes to support the annual FISMA Report to gauge agency efforts to meet the June 2014 deadline,” said an OMB spokesman in an email statement. “As necessary, OMB will work with agencies if the deadline isn’t met.”

Federal CIO Steve VanRoekel updated the PortfolioStat process in May detailing a series of deadlines.

The first was May 30, by which time agencies had to identify their programs that will go through the PortfolioStat process and by May 31 when they must update their integrated data collection to assess progress against their 2013 goals. Then, by June 19, OMB will finish its assessment of agency programs and schedule a two-hour PortfolioStat session to happen before July with agency CXOs.

So we really will not know how agencies are doing with FedRAMP compliance until September at the earliest when the PortfolioStat sessions are completed and analyzed.

And remember, agencies have a fair amount of leeway in meeting FedRAMP because if a vendor they want to use or are using isn’t approved, but in the queue to be approved and all signs are positive, that is good enough.

The enforcement piece also will fall to agencies within their contract requirements, meaning new contracts or follow-on task orders will include clauses mandating FedRAMP compliance.

Currently, there are 12 cloud service providers with approval from the Joint Authorization Board (JAB) — made up of the General Services Administration and the departments of Defense and Homeland Security — and four with agency authorizations.

Click on the image to view larger.

Government sources say the JAB is activity processing 14 cloud providers and has eight others in the queue.

One government source, who requested anonymity in order to speak to the press, said the JAB has the ability to process 10-to-12 vendors at a time.

The source said the JAB will have a schedule in place likely by next week as to when those eight in the queue will be ready to provide FedRAMP compliant services.

“The JAB expected some cloud providers to be ready last fall, but some have dragged their feet,” the source said, explaining why there is a waiting list. “They waited to early this year to submit paperwork and that threw the JAB off schedule.”

And don’t forget, the JAB recently updated the cloud security standards to meet new controls under the National Institute of Standards and Technology Special Publication 800-53 Rev 4. This means current and future cloud services providers will go through the process, to some extent at least, again over the next 12-18 months.

GSA held the first of two FedRAMP information days with the first being June 4 for industry, and the next one happening June 10 at the agency’s National Capital Region building on 7th and D Streets in Washington, D.C.

If you missed the June 4 industry day, here’s the slide deck from that event.


OMB’s word of the year: Effectiveness

Going back to PortfolioStat for a moment, OMB is placing a lot of emphasis, and expectation, on the investment review process this year.

Effectiveness is the key word coming from VanRoekel, his boss, Beth Cobert, OMB’s deputy director for management, and others from OMB.

“Based on the lessons learned last year, we have made some additional changes. For example, in the past, in the first two years of PortfolioStat we really focused on identifying opportunities for cost savings. That’s resulted in identification of almost $2 billion worth of savings opportunities,” said OMB deputy CIO Lisa Schlosser during a panel discussion on the 24th annual CIO Survey sponsored by TechAmerica and Grant Thornton on June 5 in Washington. “We revised PortfolioStat a bit this year. We aren’t just focused on creating efficiencies, but effectiveness. How do we really look at the outcomes that we are driving from our investments? How are we better serving the customer? You will see a lot of emphasis on measuring customer satisfaction.”

As part of the PortfolioStat effort, OMB issued the annual 42-page fiscal 2016 IT budget capital planning guidance on May 27. In the IT portfolio section, OMB detailed the 48 data elements that need to be answered in their budget submission.

OMB also highlights effectiveness in the IT capital assets/investments section. In that part of the guidance, OMB stated agencies should implement a process that simplifies or otherwise redesigns “work processes to reduce costs, improve effectiveness and maximize the use of commercial services and off-the-shelf technology.”

Effectiveness also popped up in the operational data section where OMB told agencies to develop operational metrics, of which at least three should “measure the effectiveness of the investment in delivering the desired service or support level. One metric should reflect customer results (e.g. service quality); another should reflect how processes and activities were improved to produce these results (e.g. productivity); and the other should reflect a technology metric (e.g. reliability and availability).”

Other metrics should focus on strategic and business results, financial performance and innovation.

On a totally different OMB note, Schlosser said the CIO Council and the Chief Human Capital Officer’s Council got together in the last few months to figure out the IT workforce issues they should address collaboratively.

Schlosser said the CIO Council’s workforce subcommittee is leading this effort with the CHCO Council.

“What are the skill sets we need to put in place now? What are the emerging skill sets like the digital service experts or like the cyber liability engineers that can operate in today’s environment,” Schlosser said. “The second part of that is looking at the way we are training individuals who are currently in the government to take on those roles and take on roles like agile development process. We are still kind of training on waterfall methodology in the federal government. We need to train agile development.”

She said the workforce subcommittee will develop a strategy for which workforce issues need addressing first. Schlosser said that plan should be out by late summer or early fall.


Kerber joins GSA to lead cloud credential program

A new, but familiar face is coming to government to run the Federal Cloud Credential Identity Exchange (FCCX) at the policy level.

Jennifer Kerber will join the General Services Administration in its Office of Citizen Services and Innovative Technologies, sources confirmed.

This will be Kerber’s first stint in government, but she’s been in the federal community for more than a decade. Kerber comes to GSA from the Government Transformation Initiative, where she served as executive director since April 2013.

Sources say GTI, which has been focused on the financial transformation of the federal government to make it more efficient and effective, will go dormant for several reasons, including its chairman David Walker’s decision to run for Lt. Governor of Connecticut.

As the director of the FCCX, Kerber will work in partnership with the Postal Service, NIST and other agency partners of the program. Kerber is replacing Katie Lewin, who retired in March and now works for CSC.

Kerber comes to GSA to run the FCCX program at a critical time. Postal Service is expected to launch the first iteration of the credential exchange this spring.

Prior to GTI, Kerber spent 8 ½ years at TechAmerica, including the last nine months of her time there as president of the TechAmerica Foundation.

Kerber also has worked for Jefferson Consulting Group.

Also on the move at GSA is Sonny Hashmi. The acting CIO since January and deputy CIO since January 2011, Hashmi ascended to the permanent top technology spot this week.

Not really a surprise, as Hashmi has shown he’s a deserving successor to Casey Coleman, who left government in January after seven years as GSA’s CIO.

“The advice I would extend is something that was once passed along to me: ‘The bigger the job, the more distractions there are. Staying focused on what is actually being achieved is what matters. Try to look back on any given day, week, or month and be able to say ‘Here’s what we got done,'” said Coleman, who is now a client executive vice president at AT&T Government Solutions, in an email to Federal News Radio.


Senate committee pushes back on funding cut to NSTIC

The other bit of good news for federal identity efforts came from Senate lawmakers, who reversed their House counterparts in funding the National Strategy for Trusted Identities in Cyberspace effort for 2015.

House lawmakers are showing signs of losing their patience with the NSTIC program after only two years when they cut its funding to $5.9 million from $16.5 million next year.

“Given the lack of progress associated with the pilots funded thus far, the recommended amount only supports ongoing programmatic efforts and does not include the second year of funding for fiscal year 2014 grant awardees or funds to award new grants in fiscal year 2015. NIST shall provide a report to the Committee within 120 days of enactment of this Act regarding the status of each of the pilots funded and milestones achieved, the near-term plans for continuing this program, and proposed future efforts. NIST shall use the remaining $10,600,000 proposed for NSTIC to enhance research and standards activities in its core lab programs,” the House report stated.

The House passed the Commerce, Justice and Science 2015 appropriations bill on May 30.

But Senate Appropriations Committee approved the CJS bill with the full $16.5 million going to NSTIC.

First, the full Senate must pass the CJS bill with the provision, and then the two houses of Congress must agree to a final bill. But the fact the Senate committee didn’t go with the House cut is an important milestone.

Along with the funding for NSTIC, the Senate committee also approved $401 million for the FBI’s next generation cybersecurity initiative and $159 million for the National Science Foundation’s comprehensive national cybersecurity initiative.

IT Job of the Week

The Labor Department’s modernization effort is looking for a new leader. The agency has a job opening for an associate deputy CIO, who will plan, direct and facilitate key elements of the department’s IT modernization project. It’s a major program and multiyear effort to consolidate numerous IT infrastructures within Labor, which will result in shared services that are common among the agencies.

Applications are due June 27.

RELATED STORIES:

May 23 — Inside the Reporter’s Notebook: FedBizOpps contractor admits to hacking

May 9 — Inside the Reporter’s Notebook: GSA takes 18F on a magical mystery tour

April 28 — Inside the Reporter’s Notebook: The funny side of strategic sourcing; NSTIC turns 3


Inside the Reporter’s Notebook: FedBizOpps contractor admits to hacking

“Inside the Reporter’s Notebook” is a biweekly dispatch of news and information you may have missed or that slipped through the cracks at conferences, hearings and the like.

This is not a column nor commentary — it’s news tidbits, strongly sourced buzz, and other items of interest that have happened or are happening in the federal IT and acquisition communities.

As always, I encourage you to submit ideas, suggestions and, of course, news to me at jpmiller@federalnewsradio.com.


President of FedBizOpps contractor pleads guilty to hacking

The president and chief technology officer of the government contractor who runs FedBizOpps.gov and two other governmentwide acquisition websites pleaded guilty to criminal hacking charges Wednesday.

Ariel Friedler, president and CEO of Symplicity Corporation, pleaded guilty in federal court May 21 to conspiring to hack into the computer systems of two education sector competitors to improve his company’s software development and sales strategy, according to a Justice Department release. Alok Dhir, CTO of Symplicity, also is charged in the crime. He is expected to enter his plea in court in early June.

The Justice Department said maximum penalty for Friedler is five years in prison, $250,000 fine, full restitution and three years of supervised release for violating the federal Computer Fraud and Abuse Act (CFAA). He will be sentenced on Aug. 1 in the Eastern District Court of Virginia.

Under the plea deal, Friedler agreed to pay Maxient $217,097.60.

Emails to Friedler and Friedler’s attorney David O’Brien, of Crowell- Moring, seeking comment were not immediately returned.

Symplicity spokeswoman Victoria Chapa said the company “has not been — and will not be — charged in this matter and the company will continue to provide its millions of users with secure, reliable platforms for effective information management without interruption. It is also important to note that this incident related exclusively to Symplicity’s business in higher education.”

Chapa added none of Symplicity’s work with the federal government or any related systems were implicated in the case, and those aspects of Symplicity’s business remain completely separate from this matter.

Symplicity also announced Bill Gerety is its new CEO, and Samuel Ramer will be its new general counsel.

Chapa said Friedler and Dhir have resigned from Symplicity, effective immediately.

PandoDaily first reported the Justice Department’s conviction.

“We hope that the court recognizes the tremendous damage done here,” said Aaron Hark, co-founder of Maxient, a software company providing student conduct applications to the education sector. “It was nice to finally see after multiple years in our industry of him denying this and claiming this was a one-sided allegation and attempt to make corporate gain that in fact, it was his attempt to make corporate gain. It was nice to see that come to light. This is something the federal government needs to take notice of.”

The FBI began investigating Symplicity in 2009 and issued a warrant at the company’s offices in March 2012 after witnesses came forward alleging Friedler hacked into the computer networks of Maxient and Pave Systems, another education software company.

“This was a sad but inevitable outcome after an FBI investigation that lasted for more than two years. Mr. Friedler’s actions and those of his associates were illegal and plain wrong,” said Ghassan Nino, president and CEO of Pave Systems Inc. “I hope this sad situation does not sour the higher education community on the market. This market is full of good companies that follow the rule of law and stand for integrity, leadership and innovation.”

While Symplicity says this is separate from its government business, there is potential that GSA or another agency could suspend or even consider debarment proceedings.

Under the Federal Acquisition Regulations, an agency could suspend a contractor for the “commission of any other offense indicating a lack of business integrity or business honesty that seriously and directly affects the present responsibility of a government contractor or subcontractor.”

In addition to FedBizOpps.gov, Symplicity also runs the electronic subcontracting reporting system and the Catalog of Federal Domestic Assistance. It also recently won a contract from the State Department to provide constituent relationship management system in the cloud.


3 takeaways from not your usual MOC

If you didn’t make it down to scenic Cambridge, Maryland, last week for ACT-IAC’s annual Management of Change conference, you missed a new approach to conferences. Instead of the standard panel discussion format, ACT-IAC tried something a bit more novel.

In some rooms, presenters and audience members sat around tables to exchange ideas based on a specific topic and the presented to the group. Or in other cases, panelists were on a stage for less than 10 minutes and then joined the audience for a discussion led by a moderator-including our own Francis Rose, who along with other media members caused quite a bit of a stir when the discussion shifted to how the government needs to do a better job talking about success stories, and how too often agency press offices get in the way of celebrating all that is good and right with government.

Here are a couple of key takeaways from MOC:

  • OASIS isn’t the only new approach to buying services in government. The General Services Administration is seriously considering consolidating all the schedules that currently provide professional services, including MOBIS, professional engineering, finance and accounting and others, into one mega-schedule. Tiffany Hixson, GSA’s Northwest Artic Region commissioner of the Federal Acquisition Service, said consolidating existing professional services contracts would save GSA money, agencies time and vendors hassle. She said GSA could reduce the number of professional services contracts it manages by more than 500, meaning companies on, say MOBIS, PES and FABs, wouldn’t have three schedule contracts anymore, only one. To be clear, no one would lose their schedule contracts. Hixson said in some instances GSA must negotiate seven different schedule contracts with the same vendor. She said GSA is hoping to schedule an industry day in June to discuss its plans.
  • Few audience members could get past Patrick Kennedy’s, the State Department’s undersecretary for management, delivery of his speech Tuesday night. It was not a highlight of the conference by any means. But if you could see the forest through the trees, Kennedy highlighted significant progress by State on several notable IT programs. He said the enterprise data quality initiative is creating standards, including a full glossary and taxonomy. State, for example, had 300 different titles for someone who drove around officials at an overseas post. Kennedy said the EDQI strategy will help ensure officials have accurate and useful information to make decisions. Another program, the Integrated Logistics Management System (ILMS), could save the department more than $100 million by improving how they buy, transport and oversee goods and services. While the program has been around for some time, Kennedy said ILMS is one of the ways State is trying to deal with a 4 percent cut to the foreign service budget. Finally, Kennedy highlighted State’s green building program. He said 100 building worldwide are using smart metering technology to adjust the temperature, lighting and other traditional functions that use a lot of electricity. He said in Thailand, the smart metering systems reduced energy consumption by 13 percent and will save State $300,000 this year. State plans to install another 100 meters in buildings around the world this year.
  • An important clarification about comments David Bray, Federal Communications Commission CIO, made at the conference’s final plenary session Tuesday. Bray caused quite a buzz among GSA and others when he said lawyers were not letting the agency use GSA schedules because of concerns about anti-deficiency act violations. After doing some research, the real problem, I’m told, is around how the FCC buys software and cloud services. FCC lawyers, it seems, are concerned over the agency entering into contracts where it wasn’t getting all the products up front, but on a monthly or yearly basis. Therefore the concern is the government is paying for something it doesn’t receive all at once and that could cause an anti-deficiency act violation, in their eyes. Bray said the problem wasn’t just with GSA schedules but any cloud or software buy and it would add three to six months to the timeline for the lawyers to alleviate any concerns. But now it seems the issue is getting cleared up pretty quickly as FCC lawyers are getting a crash course on procurement rules.


FITARA’s chances in the Senate? TBD

As the Federal Information Technology Acquisition Reform Act (FITARA) gets a second go around in the House’s version of the Defense Authorization bill, the bigger question is whether the Senate is ready to play ball.

If you remember last year, the House included FITARA as part of the 2014 NDAA it passed, but the Senate Armed Services Committee worked with lower chamber lawmakers and decided not to move forward with that section of the bill.

Reps. Darrell Issa (R-Calif.) and Gerry Connolly (D-Va.) introduced an updated version of FITARA in February. Issa and Connolly offered the bill as an amendment to the NDAA on May 20 and it was passed along with a block of provisions.

As the bill now goes back to the Senate, all eyes point to Sens. Tom Carper (D-Del.) and Tom Coburn (R-Okla.), chairman and ranking member of the Homeland Security and Governmental Affairs Committee.

If Carper and Coburn find enough they like about the bill and the administration decides not to make too much of a stink about it, then there’s a pretty good chance of FITARA becoming law as part of the NDAA.

As of now, that doesn’t seem likely-at least for FITARA as the House passed it.

At the recent committee hearing on IT acquisition, both Carper and Coburn asked witnesses about FITARA and IT reforms.

“While we appreciate their hard work on the legislation and share many of their same goals, based on these charts it’s not clear how many of these success factors could be encapsulated in legislation,” Carper said referring to a chart showing nine success factors for federal IT programs.

Federal CIO Steven VanRoekel said many of the best practices are about comprehensive management and it’s hard to legislate those actions.

“A starting point if you look at a proposed bill like FITARA, I think there is a disconnect between appropriators and authorizers. There is a money aspect here as much as there is an authorization aspect, and thinking about that duality in the work that is being done,” he said. “I think we have an opportunity in incentives and thinking about what outcomes we want to see. I also fear a lot of what we see in legislation that looks at technology is technology is moving so quickly. If we were sitting here 15 years ago, the notion of doing agile approaches or even Internet approaches in government weren’t as self-apparent as they are today. So looking at how do we think about what outcomes we are trying to drive versus what are the tactical ways we will get there is essential because we are moving so far. We are moving so fast. We are moving fast enough that our procurement system can’t keep up with it and we need to think about modern approaches to get there.”

To translate for VanRoekel, the White House still doesn’t see the need for FITARA.

Dan Tangherlini, GSA administrator, toed the party line by saying he didn’t think legislation is the answer for ensuring senior leadership attention to IT projects.

“You can require it, but it won’t necessarily result in it,” he said. “What we need to do is continue to work as we have been closely with Steve to bring these best practices into our agencies and we need to make sure there is transparency and as a result accountability through strong oversight from Congress, seeing how we are performing and getting the work we say we will get done, done.”

But isn’t that the point of the legislation? If the law is updated to reflect changes in the importance and need for oversight of IT, Congress will pay attention, ask for reports, write letters of concern and hold hearings-which is exactly what Tangherlini just said was needed.

The Government Accountability Office’s David Powner seemed to agree that changing the law to require more oversight and attention would be good. He said legislation is important in two areas: data center consolidation and IT dashboard reporting. Both of these would hold agencies more accountable for their reporting of data and progress.

Again even GAO’s focus is not about management responsibilities, but changes to how agencies manage IT and how Congress expects oversight to be exacted.

Coburn countered VanRoekel and Tangherlini’s arguments by saying one of the points of the new law called the DATA Act is so agencies can get the information to better manage their projects. Coburn said they don’t have it currently.

“I really appreciate Steve what you are doing, implementing a management capability. That’s been the real problem. It’s not that we don’t have great employees,” he said. “It’s that we have a skill set that hadn’t been up to the task. So what you are doing is very important in that regard.”

The committee passed on May 6 one piece of FITARA, the Federal Data Center Consolidation Act.

Carper said he may try to get it pushed through the full Senate and have it passed under unanimous consent.

IT Job of the Week

A best of both worlds situation for an aspiring intel techie. The Defense Department’s Defense Security Service seeks a senior adviser for IT and CIO. This looks to be an in-the-weeds senior IT job that requires the candidate to be able to establish short and long term IT visions including an architectural roadmap, while also maintaining the enterprise security system and all applications supporting the National Industrial Security Program, Counterintelligence, Center for Development of Security Excellence and headquarters elements. A top secret security clearance is required. Applications are due June 6.

RELATED STORIES:

May 9 — Inside the Reporter’s Notebook: GSA takes 18F on a magical mystery tour

April 28 — Inside the Reporter’s Notebook: The funny side of strategic sourcing; NSTIC turns 3

April 11 — Inside the Reporter’s Notebook: OMB not a farm team, Strategic sourcing on steroids


Inside the Reporter’s Notebook: GSA takes 18F on a magical mystery tour

“Inside the Reporter’s Notebook” is a biweekly dispatch of news and information you may have missed or that slipped through the cracks at conferences, hearings and the like.

This is not a column nor commentary — it’s news tidbits, strongly sourced buzz, and other items of interest that have happened or are happening in the federal IT and acquisition communities.

As always, I encourage you to submit ideas, suggestions and, of course, news to me at jpmiller@federalnewsradio.com.


GSA takes 18F on a magical mystery tour

The mystery of what really is 18F is solved.

The General Services Administration hosted a “meet up” or was it a “poolza” of sorts Friday to introduce agencies, the media and vendors to its mysterious new startup.

“18F is all about the way we transform how we deliver services, and the way we work with agencies and vendors,” said GSA Administrator Dan Tangherlini. “Mobile devices and other things like cloud have transformed the way services are delivered and we must recognize it’s happening. We need to look inward and see how we can deal with these disruptions through creative ways.”

18F is that approach — A lean startup focused on agile development and quick wins. Projects are designed to prove a solution to a problem is possible, value is delivered quickly and at a low cost.

“The technology disruption we’ve seen is a factor, but it’s also we need to show that technology programs need to be done in a reasonable timeframe,” said Dave McClure, the associate administrator in the Office of Citizen Services and Innovative Technologies, who is retiring as of May 30. “They still take too long. There still are too many failures. 18F is a different approach to get faster results and gain confidence in the government.”

GSA detailed eight projects on everything from usability testing of application programming interfaces (APIs) to business process reengineering of software development and the hiring process to a new way to track vendor progress in becoming a government contractor like you order a pizza from Dominos.

With several of the programs, such as FBOpen, it reminded me of an updated attempt at what the Quicksilver e-government initiatives tried to do — consolidate websites and data. In fact, Mark Forman’s mantra quickly ran through my head: Say it with me: “Three clicks to service … don’t pave the cow paths … don’t put lipstick on a pig” and so on and so forth.

FBOpen is trying to make it easier for small businesses to find potential contract opportunities. It takes all the data that’s already out there and using a “thin API” searches, indexes and filters the information and puts it on a public website.

These technologies didn’t exist in the early aughts, but the concept is the same. So is what’s missing? Finding data is great, but if you can’t bid or apply, then what’s the point, especially in light of the fact that we already have Google, Bing and Yahoo!, which are all a lot better than anything the government can build.

In fact, most of the time when I’m looking for a specific procurement, one of these search engines is my go to, and if I’m just searching on FedBizOpps.gov- which by the way is one of the worst websites in government, hint, hint to the 18F folks-its search engine is more than passable.

To be fair, FBOpen is all of about a month old so there are more capabilities coming and once the APIs are out there developers can improve upon the initial site.

One of the more impressive projects 18F is sponsoring is called MIDAS. It’s an internal crowdsourcing program currently run by the State Department and the Department of Health and Human Services to connect employees across their respective agencies to help on projects.

Matt Chessen, a foreign service officer, said many junior foreign service officers begin their careers processing visas at consulates around the world, but have requirements and desires to do more creative and innovative work.

He said through MIDAS, they can find micro-projects to work on a few hours a week or a total of a few days a month.

Chessen said MIDAS is about to launch into a four-week pilot in a yet to be determined country, and then if all goes well, expand it to other parts of State.

GSA plans on holding this type of event every three months to educate and update agencies on their progress and plans.

Now even with the mystery of 18F solved, industry remains concerned about the organization and what its impact will be on contracting.

The Coalition for Government Procurement wrote a letter to McClure on May 5 asking for assurance that 18F will promote an open and competitive procurement process.

“Finally at the commencement of an acquisition of a system or capability, the government should understand the existence of any fees, costs or charges attendant to that acquisition in order to protect the government’s financial interests and to avoid violations of appropriations laws,” writes Roger Waldron, president of the coalition. “The government should assess costs of a technology or system over time, rather than focus solely on upfront acquisition costs (price alone). The time and resources to maintain technology or a system substantially may exceed the upfront acquisition costs.”

Waldron is a bit cryptic on what CGP’s concerns are. But industry, generally speaking, is worried that 18F will offer competing, less costly development services that will be unfair competition.

Now 18F must work as a cost recovery center so as not to violate the Economy Act of 1932, but how much it will charge customer agencies for its services is unclear right now.

And one government official associated with 18F said industry’s long list of failures are part of the reason why GSA decided to go in this direction, but at the same time they shouldn’t be too concerned either as the office is focused on iterative, low cost proofs of concepts


PTO’s sequestration recovery time is 18 months

One of the best examples of the impact of sequestration on the government comes from the Patent and Trademark Office.

Despite the fact PTO is funded almost solely from user fees, the Office of Management and Budget decided it had to cut PTO’s budget by $148 million last year.

Tony Scardino, the PTO chief financial officer, said executives had six months to figure it out and wouldn’t and couldn’t cut anything that brought in money such as overtime hours for patent and trademark reviewers.

Well, that didn’t leave much for PTO to cut, so it started with back office and administrative projects, such as technology.

Scardino, who spoke at the Government Performance Summit in Washington Wednesday, said they cut travel and training and froze hiring, but that was piddly compared to technology programs.

Scardino said PTO cut $80 million from its IT projects, and let go of about 500 vendor employees from contracts, including 300 from the patent end-to-end program. You remember that one, it was called out by President Barack Obama in his 2011 State of the Union address.

PTO kept a skeleton crew of about 10 contractors and, during the sequestration and shutdown, four of those 10 left to take new, more stable jobs.

Scardino said in the six months it took to cut the $80 million, it will take 18 months for PTO to fully staff back up and get back on track.

“We need to rehire the vendors. We had to look at new contracts or current vendors had to find new employees, because they were moved to a new project or left the company,” he said. “There’s also a huge learning curve to get us back to full force.”

Scardino’s description of sequestration’s impact likely isn’t unusual, but it’s interesting he talked so openly about it and it’s one of the few concrete examples we’ve heard of over the last few months.


HSPD-12 turns 10, agency progress a 6.7

August will be the 10-year anniversary of Homeland Security Presidential Directive-12. At the time of the policy issuance, it wasn’t one of those seminal moments in federal IT history. But over the years, the smart identity card program has come to resemble all that is good and bad with government.

First the good: HSPD-12 was ahead of its time. OMB recognized both the threats agency networks face and the potential physical security benefits of having a single, standardized identity card that uses — at the time — cutting edge technology.

Now the bad: A decade later, only 67 percent of the agencies have deployed the logical access capability to secure their computer networks. This is more than just disappointing, but borderline dereliction of duties given the Defense Department’s proof that smart identity cards reduce cyber risks and attacks by more than 50 percent.

OMB rolled out the latest progress report on HSPD-12 and a host of other cybersecurity initiatives as part of its annual Federal Information Security Management Act (FISMA) report to Congress.

Agencies are making progress against the HSPD-12 mandate, which OMB reset for a third time in 2011. Agencies had until the beginning of fiscal 2012 to make all logical and physical systems HSPD-12 compatible. As this latest report shows, most agencies haven’t achieved the mandate.

“In FY 2013, mandatory PIV use increased to 13 agencies reporting 6 percent or better, three agencies reporting 30 percent, and five agencies reporting 66 percent or better,” OMB stated in the report. “Of the remaining 11 agencies, two reported between 1 percent and 4 percent of employees were required to use their PIV cards to authenticate to the agency network, and nine reported 0 percent.”

GSA has made the most progress with 94 percent of employees required to use their smart cards for logical access while with the Social Security Administration at 85 percent and DoD at 89 percent are in good shape.

But the list of agencies not using their cards for what really matters the most, computer network access, is too long. The departments of Housing and Urban Development, Interior and Labor and the Small Business Administration, the Office of Personnel Management, the Environmental Protection Agency, the Nuclear Regulatory Commission, the Agency for International Development and the National Science Foundation have made little to no real progress after almost a decade.

There is plenty of blame to go around. OMB hasn’t used the power of its purse to require investments in the identity management technology. Agency leadership, including CIOs, either don’t understand or accept the benefits of logical network access because if they did, given DoD’s experience, it would be done by now and we would be talking about the next generation of HSPD-12 requirements.

Two other major cyber priorities are showing better progress.

The Trusted Internet Connection, which has a goal of consolidating Internet access points and implementing software tools to monitor the health of those connections, is further along than ever before.

“The consolidation of external network traffic increased from 81 percent in FY 2012 to 86 percent in FY 2013 for the 24 CFO agencies (excluding DOD),” OMB stated, adding DoD is exempt from TIC because it implemented an equivalent initiative. “The implementation of TIC Reference Architecture Version 2.0 critical security capabilities also increased from 84 percent in FY 2012 to 87 percent in FY 2013.”

Agencies also saw an uptick with its implementation of continuous diagnostics and mitigation of their network and software going to 83 percent from 81 percent.

OMB reported most of the increase came in the area of configuration management, while asset and vulnerability management saw overall declines mainly because agencies reported more than a million additional assets last year and only three- quarters of them are under automated asset inventory or vulnerability management.

Finally, the Einstein 3 Accelerated program is on tap to have a break out 2014.

Phyllis Schneck, the DHS deputy undersecretary for Cybersecurity and Communications at DHS, told the House Appropriations Committee in late April that DHS would like $378 million in fiscal 2015 to get E3A up to full operational capability by 2016.

Schneck told lawmakers that only one agency, through the only Internet Service Provider (ISP) approved to offer E3A services, is taking advantage of the intrusion prevention capabilities. As of February 2014, seven departments and agencies are using the Domain Name System and/or email protection services under Einstein 3.

“The initial deployment of E3A is focused on countermeasures that will address 85 percent of the cybersecurity threats affecting the Executive Branch civilian networks,” OMB stated in its report. “For FY 2014, the DHS Office of Cybersecurity and Communications will continue with the rollout of E3A and securing memorandums of agreement with all departments and agencies.”

All of this data and effort comes as agencies face an increasing number of cyber attacks. In 2013, departments reported a total of 218,886 incidents reported to DHS U.S. Computer Emergency Readiness Team-a 26 percent increase over 2012.

“Phishing, a type of social engineering attack, continues to be the most widely reported incident type across total incidents reported. [P]hishing accounted for 71.9 percent of total incidents reported, followed by non-cyber incidents at 6.9 percent and policy violations at 5.4 percent,” OMB stated. “It should be noted that federal agencies are not required to report attempted phishing incidents and primarily report incidents that involve the actual compromise of IT assets and/or spillage of sensitive information.”

IT Job of the Week: One of the hardest and most cutting edge CIO jobs is open. The Indian Health Service in HHS is looking for a director of IT. This Senior Executive Service position will oversee the typical CIO duties of managing the acquisition, development, enhancement, deployment, support and training of technology. The person also will have to know the ins and outs of electronic health records (EHR), clinical decision support, health information exchange, and related technologies to IHS customers. Here’s the most recent interview we did with acting CIO Howard Hays back in October 2012. Act quickly, the job closes May 16.

RELATED STORIES:

April 28 — Inside the Reporter’s Notebook: The funny side of strategic sourcing; NSTIC turns 3

April 11 — Inside the Reporter’s Notebook: OMB not a farm team, Strategic sourcing on steroids

March 28 — Inside the Reporter’s Notebook: DoD taking own path with cloud security, Treasury’s Reger joins OMB


Inside the Reporter’s Notebook: OMB not a farm team, Strategic sourcing on steroids

“Inside the Reporter’s Notebook” is a biweekly dispatch of news and information you may have missed or that slipped through the cracks at conferences, hearings and the like.

This is not a column nor commentary — it’s news tidbits, strongly sourced buzz, and other items of interest that have happened or are happening in the federal IT and acquisition communities.

As always, I encourage you to submit ideas, suggestions and, of course, news to me at jpmiller@federalnewsradio.com.


OMB is not the government’s farm team

I was once told if you ever get a chance to work at OMB, take it. It’s filled with incredibly dedicated, hardworking career staff who are the best of the best.

Too bad the Obama White House doesn’t seem to understand that.

I was going to write about OMB’s budget request and how their staff is down by 11 percent since 2010, yet their workload has increased — 40 mentions of OMB in the Government Performance and Results Modernization Act as compared to 18 mentions of OMB in the original GPRA in 1993.

But the budget request doesn’t really matter if the White House can’t keep consistent leadership at the helm.

The nomination of Director Sylvia Burwell as the next secretary of the Department of Health and Human Services makes sense, but it’s not a good decision by White House leaders.

It’s not that Burwell isn’t qualified to be HHS secretary. She’s shown in the 12 months as OMB director that she plans on doing some good things. She is cool under pressure before Congress and seems to understand the need to rebuild OMB, requesting a $4.2 million increase in its budget for 2015.

But the decision also shows the lack of understanding by the White House of the importance of OMB — the same thing can be said about GSA and the Office of Personnel Management, for that matter.

Not having consistent leadership is hurting OMB’s standing in the federal community. I’ve heard this from several current government executives and former OMB staff members. OMB doesn’t carry the influence it once did, and that has a ripple effect across how well the government is managed.

None of the OMB directors during the Obama administration has stayed on the job for more than 18 months — Peter Orzag, 18 months; Jack Lew, 14 months; Burwell, 12 months. And Jeff Zients has been acting twice and, possibly, is in line for a third go around considering OMB deputy director for management Beth Cobert has been in government for a very short amount of time and has no previous federal experience, and Brian Deese, the deputy director for budget, is more of a numbers guy than the type of political insider needed to deal with Congress.

Compare the Obama administration’s record with OMB directors with the previous two administrations:

President George W. Bush: Mitch Daniels, 29 months; Josh Bolten, 34 months, Rob Portman, 13 months, Jim Nussle, 16 months- end of administration;

President Bill Clinton: Leon Panetta, 21 months; Alice Rivlin, 18 months; Franklin Raines, 20 months; Jacob Lew, 32 months-end of administration.

This means most of the previous OMB directors had time to create relationships with Congress, go through at least two budget cycles and influence management concepts across government. Additionally, almost all of the former OMB directors came to lead OMB with connections to Congress already. That is not necessarily true for the Obama leadership, and that has hurt its effectiveness.

Moving OMB directors in and out quickly also causes others to be thrust into acting roles and that has a snowball effect. Again, it’s not about the effectiveness of the people in acting roles — Danny Werfel was acting deputy director for management and became the acting IRS commissioner — but there is an importance that is attached to being permanent versus acting and how management issues are focused upon across the government.

Burwell will be a successful HHS secretary, but it’s a shame it’s at the expense of governmentwide management.


GSA pumps up new approach to buying

S trategic sourcing on steroids. That may be the best way to describe the General Services Administration’s new category management concept rolled out by Tom Sharpe, Federal Acquisition Service Commissioner, Wednesday in a blog post.

A year ago when he was about a month on the job, Sharpe told me one of his main goal was to grow the federal market share of FAS, including the schedules. In fiscal 2012, FAS brought in about $55 billion in sales, about 13.5 percent of all acquisition spending. Sharpe said he’d like to see FAS’ share increase to about 17 percent.

Through category management, Sharpe said GSA can provide a more coordinated, strategic approach to governmentwide purchasing and more cost savings.

“Category management essentially looks at product or services categories the way a business might look at its own strategic business units, and then works on customizing purchase channels to better meet customer needs and market demands. Category management also provides deep-dive market analysis and addresses supply chain management; it can even help with changing behaviors, and reducing demand,” Sharpe wrote in the blog. “For FAS, this means we are identifying core categories of business around which we will develop a higher level of expertise, and then leveraging this expertise to direct and guide buyers to the best solutions for them, and ultimately those in the best interest of the taxpayers, regardless of where that solution comes from. Sometimes that solution will be a GSA contract vehicle and other times, it might be another agency’s contract vehicle.”

Think of category management as a highway with an assortment of stops along the way. Contracting officers or program managers eventually will access a series of tools and resources through a new Common Acquisition Platform (CAP).

“CAP will provide access and insights into transactional (purchasing/pricing) data from across government and reduce the need for maintaining redundant and duplicative acquisition vehicles, systems and tools,” Sharpe wrote. “GSA has a unique position in the government marketplace as a repository of purchasing information and expertise related to best practices, buying behaviors, and prices paid. Through the CAP, GSA will make this information and expertise easily accessible online for all government buyers. We will help buyers navigate the process and the universe of purchasing options, thereby helping them to drive down prices, reduce price variability and make smarter purchases.”

The tools or resources that FAS will make available on CAP include:

  • Procurement Optimizer: A comprehensive contract-comparison search engine that enhances competition for government acquisition.
  • Market Intelligence Center: Category-centric market research materials that guide purchase decisions based on a category manager’s governmentwide expertise.
  • Clear View: Real-time data on pricing and purchasing, as well as assessment tools that help provide a big-picture view of government and individual agency spending behavior.
  • Collaborative Contracting Library: Provides a resource to jump-start procurements with a central repository of exemplary contract work for complex buys compiled by community experts.
  • eMarketplace: An eCommerce transaction platform for simple purchases.

“Initially, we are focusing on a concept we call ‘Category Hallways.’ Here is how the hallways will eventually work. Before any federal buyer goes out to the marketplace with a procurement, they will enter CAP through a digital gateway and choose a category, or search for the product or service they need,” Sharpe wrote. “From there they will virtually ‘walk’ down a hallway which houses everything from subject expertise and data, to tools and on-demand procurement assistance. All of which is specific to exactly what they are looking to purchase. The hallways will house both advice and acquisition sources that governmentwide category managers have determined would help professionals make better buying decisions.”

One last point, the blog post seems to be the final piece to a year-long discussion with vendors, associations and agencies to put a finer point on the concept of category management. Now the hard work begins — implementation and education.

Reaction to category management has been cautiously optimistic.

Larry Allen, the president of Allen Federal Business Partners and a long-time GSA expert, said if the goal is to replace GSA Advantage then category management is a good thing.

“Advantage was great for what it was, but we need a 21st Century marketplace in the federal arena. A flexible emarketplace could be that,” he said. “I also like the idea of a collaborative library being available to share best practices. The key will be to drive people to use it. It has the potential to be a good tool, but only if potential users know about it. How will GSA do this? The market intelligence and clear view initiatives, I think, have a real risk of driving unintended consequences.”

Allen said the first concern is around how a database of “like buys” could work because pricing decisions have multiple variables and it would be difficult for any automated system to capture all of those inputs.

He said another concern is if contractors know their discounts will be made available to all agencies, then there may be less spot discounting and, therefore, the government may end up paying more than previously.

“GSA needs to be reminded of the old adage ‘If you lie down with dogs, you’re gonna get fleas.’ The agency will always be able to find people who will sell to you cheaply,” he said. “The question is whether GSA–or its customers–will be comfortable with the new company they keep.”


FAA, GSA kick off security, telecom acquisitions

Two interesting procurement actions came out over the last two weeks that you should know about.

The first is GSA’s request for information for the Network Services 2020 (NS2020) Enterprise Infrastructure Solutions (EIS) acquisition initiative — one of six program areas under the umbrella program to replace the Networx telecommunications contract.

The second is a draft statement of work from the Federal Aviation Administration to run its security operations centers (SOC) under the Security Line of Business effort.

Wait, that still exists? This is one of the few mentions of the security LOB in the past five years around SOC shared services.

In fact, OMB’s own report to Congress on E-Government benefits doesn’t mention the security operations center as part of the LOB.

The FAA is one of eight agencies under the security LOB to provide shared services.

The Office of Management and Budget named four agencies — the Treasury Department’s Bureau of Public Debt; the Interior Department’s National Business Center; the Transportation Department’s Federal Aviation Administration Enterprise Service Center; and the Justice Department — in 2009 as shared service providers for certification and accreditation services.

It also named four agencies — the departments of Defense and State, the Agency for International Development and the Office of Personnel Management — in 2007 to provide Federal Information Security Management Act training.

Agencies have taken advantage of the Justice Department’s shared service for certification and accreditation, called Cyber Security Assessment and Management (CSAM), but there’s been less discussion about shared security operations centers. Additionally, a lot of the efforts around the Security LOB have been to set up blanket purchase agreements for different levels of security awareness training.

FAA is looking for operations and maintenance support for hardware and software platforms, tools to perform event correlation, data reduction and anomalous event detection, and situational awareness and an up-to-date snapshot of cyber events that are on-going within the world of cybersecurity

In reading the draft statement of work, it seems the FAA is looking to create a continuous monitoring shared service center, which would make a lot more sense given the requirement by OMB and the Homeland Security Department to move a more dynamic approach to cybersecurity.

Now why they just didn’t say that is unclear.

Comments to the draft SOW are due April 22.

One former DHS official says FAA may be making a play at servicing small and micro agencies under the CDM program. FAA recently lost one of its largest customers, the Education Department, which decided to bring a SOC in house. The former DHS official says they were surprised to see FAA come out with the draft RFP.

As for the NS2020 RFI, this is among the first specifics GSA has released about its new strategy.

GSA expects to issue a solicitation for EIS in spring of fiscal 2015 with a contract length of up to 15 years.

The RFI details eight categories of products and services under EIS, including voice and video, network security and equipment, data center and managed services.

“This scope is intended to allow agencies to acquire comprehensive solutions through the EIS ordering process without having to compete and integrate multiple procurement actions across multiple GSA or other vehicles,” GSA stated in the RFI.

Reponses to the RFI are due May 8.

GSA has said it’s using lessons from the arduous and delayed transition to Networx in the planning for NS2020. Agencies took about 33 months more than expected and the government ended up spending almost $400 million more than it should have for telecommunications services because of these delays, according to the Government Accountability Office.

It will be interesting to see industry reaction to this RFI. Telecommunications firms were frustrated with the Networx process, but pleased that agencies continued to pay them well as they transitioned mostly to like services instead of taking more advantage of new technologies and new approaches to telecommunications.


IT Job of the Week

This week’s winner is the Federal Deposit Insurance Corporation and its search for a new chief information officer. Rus Pittman held that role since May 2010. FDIC promoted Pittman to a new position as director of the Division of Information Technology. Martin Henning is the acting CIO and chief privacy officer.

In case you are interested in knowing what you may be getting into, Pittman outlined his priorities in April 2013, including a more specific focus on mission area IT improvements.

Out&About

  • The Professional Services Council is hosting OMB’s Cobert on Tuesday to discuss security clearances in Arlington, Va.
  • On Thursday, AFFIRM has a good discussion on the future and evolving roles of the CIO featuring Kevin Cooke, HUD’s CIO; Simon Szykman, the outgoing Commerce CIO; David Bray, the FCC CIO; Paul Brubaker, DoD’s director of planning and performance management in the Office of the Deputy Chief Management Office; and former federal CIO Karen Evans.
  • The AFCEA Northern Virginia chapter is hosting Maj. Gen. Wendy Masiello, the Air Force’s outgoing deputy assistant security for contracting and nominee to be the next head of the Defense Contract Management Agency, on Friday.

RELATED STORIES:

March 28 — Inside the Reporter’s Notebook: DoD taking own path with cloud security, Treasury’s Reger joins OMB

March 14 — Inside the Reporter’s Notebook: USPS cloud credential exchange almost ready, flood of GSA contract protests

Feb. 28 — Inside the Reporter’s Notebook: CIO switching DHS components, HUD stuck in 2005


« Older Entries

Newer Entries »