E-GOV PROGRAMS

Policy Utilization Assessment Pilot Assessment

Previous Page

A pilot (or level 1) assessment of the Governmentwide implementation of Federal Desktop Core Configuration (FDCC) and Internet Protocol Version 6 (IPv6) initiatives began in May 2008 and was completed in July 2008. The pilot assessment had the following purposes:

1. To conduct a series of implementation diagnostics to determine the extent and effectiveness of agency implementation and utilization of OMB IT policies throughout the Federal government;
2. To establish an assessment methodology and best practices for use by individual agencies in improving policy implementation; and
3. To document lessons learned and government-wide trends to assist OMB in improving future IT policy development efforts.

FDCC Background and PUA pilot results
The FDCC policy establishes a common set of controls that will improve the IT security posture of the government’s desktops and laptops. By February 1, 2008, all agencies were required to implement the FDCC controls and provide sufficient documentation to illustrate their compliance with the policy. In addition, agencies are required to diagnose and monitor the implementation of the FDCC controls using approved Security Content Automation Protocol (SCAP) scanning tools. OMB memorandums and additional details for implementing FDCC are at the following website: http://nvd.nist.gov/fdcc/index.cfm.

The general finding of this assessment is that, of the agencies who have demonstrated progress in implementing FDCC, the leading sub-agencies have made significant progress in adopting the policy and meeting its requirements. However, policy adoption and implementation progress vary widely among sub-agencies and across the government as a whole.

IPv6 Background and PUA pilot results
The exhaustion of the available IPv4 network addresses is driving the need to transition the government’s core network to the next generation of Internet Protocol, IPv6, which provides a much more flexible IP addressing capability. With the explosion of the Internet and the movement towards a “Web 2.0 government”, federal agencies must proactively plan for modernizing their network backbone to implement IPv6.

As part of the pilot assessment, the PUA team chose the agencies based on a review of those agencies that had reported IPv6 compliance and also on a review of the Transition Plans submitted by the agencies. An overall assessment indicates that Level 1 agencies are embracing the transition to the next generation of the Internet as evidenced by their ability to demonstrate IPv6 compliance.

Based on this pilot assessment, it is evident that statistical sampling, analyses, and reporting of baseline reports for Agencies and Government-wide is an economical and efficient way to determine the actual effectiveness of IT policy implementation by agencies.

Previous Page