OMB is requesting an update for all agencies' current Plan of Action and Milestones (POAandMs) to include the pending modification to the NETWORX contract for TIC services which is scheduled for award on/or about November 15, 2008. The TIC Access Providers' updated POAandMs should include the above outlined steps. DHS will work with your agency to complete setup/installation activities for Einstein and other DHS specific TIC tasks based on prioritized needs for each agency. Your agency will not be considered fully compliant until DHS has provided notification to OMB of completion of the necessary activities for TIC. OMB is requesting your updated POAandMs be submitted by October 15, 2008. Wed, 01 Oct 2008 00:00:00 EST http://www.cio.gov/documents/2008_IT-Privacy_Summits.pdf The 2008 Federal IT and Privacy Summits will be held The IT and Privacy Summits will be held October 22-23, 2008, at the US Department of Commerce, Herbert Hoover Building, 1401 Constitution Ave, NW, Washington, DC. Fri, 19 Sep 2008 00:00:00 EST http://www.cio.gov/documents/2008_IT-Privacy_Summit_Agendas.pdf The 2008 Federal IT and Privacy Summits will be held The IT and Privacy Summits will be held October 22-23, 2008, at the US Department of Commerce, Herbert Hoover Building, 1401 Constitution Ave, NW, Washington, DC. Fri, 19 Sep 2008 00:00:00 EST http://www.cio.gov/documents/SAIR_RFQ_195616.zip The Information System Security Line of Business (ISSLOB) Program Management Office (PMO) established a Situational Awareness and Incident Response (SAIR) Interagency Working Group to evaluate the viability of obtaining security tools/ products for situational awareness and incident response. The outcome of the proceedings resulted in the identification of the following near-term government-wide security application needs: 1) baseline configuration management, 2) network mapping/discovery, and 3) vulnerability scanning and assessment.

The ISSLOB PMO partnered with GSA SmartBUY, a consolidated purchasing program for the acquisition of software and software maintenance, to establish SmartBUY enterprise wide Blanket Purchase Agreements (BPAs) for those SAIR “Tier I” requirements.

Government agencies routinely use commercial software to detect and prevent damage to software and data. The primary reasons for this SmartBUY government-wide program are: security, standardization, configuration management, Federal Desktop Core Configuration (FDCC) compliance, cost savings, and Federal Information Processing Standards (FIPS) 140-2 validation.

The objective is to obtain a collection of cost effective information security tools. Additionally these products shall 1) give government agencies security products with ability to check for and report FDCC compliance and prove ability to scan for FDCC compliance, 2) enable all federal government agencies to purchase security products that are, at a minimum, compliant with current NIST SCAP guidelines, and 3) Provide products via a GSA SmartBuy BPA that perform Network Mapping and Discovery, Baseline Configuration Management, and Vulnerability Assessment.

This RFQ is scheduled to close on September 23, 2008. This SmartBUY BPA will be awarded in November 2008.

For further information, contact Sharon Terango, sharon.terango@gsa.gov. Fri, 29 Aug 2008 00:00:00 EST http://www.cio.gov/documents/Networx_Transition.pdf In order to achieve maximum cost savings for the Federal Government and to improve overall security, the Federal Chief Information Officer (CIO) Council conducted a cost benefit analysis evaluating the potential Federal benefit to using the General Services Administration (GSA) Networx contract for information technology services. An executive summary of the analysis is provided in the attachment.
Based on the findings of the analysis, agencies shall use the General Service Administration (GSA) Networx contract to satisfy requirements currently being met via the FTS2001 contract. Networx can also assist agencies in meeting the requirements of OMB M-08-05, Implementation of Trusted Internet Connections (TIC), which requires agencies to optimize individual external connections, including internet points of presence currently in use by the federal government. Fri, 29 Aug 2008 00:00:00 EST http://www.cio.gov/documents/Securing_Feds_DNS.pdf to promote a more citizen centered and results oriented government. The Government's reliance on the Internet to disseminate and provide access to information has increased significantly over the years, as have the risks associated with potential unauthorized use, compromise, and loss of the .gov domain space. Almost every instance of network communication begins with a request to the Domain Name System (DNS) to resolve a human readable name for a network resource (e.g., www.usa.gov) into the technical information (e.g., Internet Protocol address) necessary to actually access the remote resource. This memorandum describes existing and new policies for deploying Domain Name System Security (DNSSEC) to all Federal information systems by December 2009. DNSSEC provides cryptographic protections to DNS communication exchanges, thereby removing threats of DNS-based attacks and improving the overall integrity and authenticity of information processed over the Internet. Tue, 26 Aug 2008 00:00:00 EST http://www.cio.gov/documents/FY2008_FISMA_Reporting_Instructions.pdf This memorandum provides instructions for meeting your agency's FY 2008 reporting requirements under the Federal Information Security Management Act of 2002 (FISMA) (Title III, Pub. L. No. 107-347). It also includes reporting instructions on your agency's privacy management program. Fri, 18 Jul 2008 00:00:00 EST http://www.cio.gov/documents/2008_HRLoB_Report.pdf This report addresses Section 747 of Division D of the Consolidated Appropriations Act, 2008, which requires the Director of the Office of Management and Budget (OMB) to submit to the Committees on Appropriations of the House of Representatives and the Senate a report on the Human Resources Lines of Business (HR LOB) initiative which is led by an interagency group composed of 24 federal agencies and managed by the Office of Personnel Management (OPM). Tue, 15 Jul 2008 00:00:00 EST http://www.cio.gov/documents/2008_Expanding_E-Gov_Report.pdf The results included in this report are for the period of performance ending September 30, 2007. Included are the results for Fiscal Year 2007 performance goals and the Fiscal Year 2008 goals. Tue, 15 Jul 2008 00:00:00 EST http://www.cio.gov/documents/FY2007_eGov_Report.pdf This is OMB's fifth annual progress report on implementation of the E-Government Act of 2002 (Pub. L. No. 107-347; Dec. 17, 2002) (the E-Government Act ) as required by 44 USC 3606. This report describes activities completed in fiscal year (FY) 2007, and is among a series of reports produced by OMB to describe the Administration's use of E-Government principles to improve government performance and the delivery of information and services to the public. Tue, 15 Jul 2008 00:00:00 EST http://www.cio.gov/documents/FY2007_FISMA_Report.pdf This report informs Congress and the public of the Federal government's security performance, and fulfills OMB's requirement under FISMA to submit an annual report to the Congress. It provides OMB’s assessment of government-wide IT security strengths and weaknesses and a plan of action to improve performance. It also examines agency status against key security and privacy performance measures from fiscal year 2002 through fiscal year 2007. Tue, 15 Jul 2008 00:00:00 EST http://www.cio.gov/documents/2008_TIC_SOC_EvaluationReport.pdf This document is a summary of the activities for the Trusted Internet Connections (TIC) Initiative from December 2007 through June 2008 that includes the development of technical and business model capabilities required for all TIC Access Providers and culminates with the evaluations of agency Statement of Capability proposals for how each intends to achieve the requirements of the TIC Initiative. Tue, 15 Jul 2008 00:00:00 EST http://www.cio.gov/documents/2008_IT-Privacy_Summits.pdf The 2008 Federal IT and Privacy Summits will be held The IT and Privacy Summits will be held October 22-23, 2008, at the US Department of Commerce, Herbert Hoover Building, 1401 Constitution Ave, NW, Washington, DC. Registration will begin Monday, September 22. Fri, 11 Jul 2008 00:00:00 EST http://www.cio.gov/registration/Federal%5FIT%5FSummit/081022 The 2008 Federal IT and Privacy Summits will be held The IT and Privacy Summits will be held October 22-23, 2008, at the US Department of Commerce, Herbert Hoover Building, 1401 Constitution Ave, NW, Washington, DC. Registration will begin Monday, September 22. Fri, 11 Jul 2008 00:00:00 EST http://www.cio.gov/documents/2008_s300.pdf Part 7 (section 300) of the Circular establishes policy for planning, budgeting, acquisition and management of Federal capital assets, and instructs you on budget justification and reporting requirements for major information technology (IT) investments and for major non IT capital assets. OMB provides procedural and analytic guidelines for implementing specific aspects of these policies as appendices and supplements to this Circular and in other OMB circulars. For IT, section 300 is a companion section to section 53. Wed, 02 Jul 2008 00:00:00 EST http://www.cio.gov/documents/2008_s53.pdf The individual agency's exhibit 53 is used to create an overall Federal IT Investment Portfolio published as part of the President's Budget. OMB's portfolio review and Budget process will ensure IT investments support the strategy identified in this section and ensure the Federal IT Investment Portfolio includes the most effective portfolio of investments. The Budget justification, including the status and plans for information systems, should be consistent with the agency's submissions for Part 7 (section 300) of this Circular. Wed, 02 Jul 2008 00:00:00 EST http://www.cio.gov/documents/Initial_Imp_Guidance_for_CUI.pdf The Controlled Unclassified Information (CUI) Framework is a critical part of a larger effort to create an Information Sharing Environment (ISE) that will facilitate the sharing of terrorism-related information. Because the CUI Framework provides for standardized handling of information, it supports the individual missions of departments and agencies and enhances our ability to share vital terrorism-related information among Federal, State, local, tribal, and private sector partners. Implementing the CUI Framework will further the ISE and help departments and agencies better management their information. Tue, 01 Jul 2008 00:00:00 EST http://www.cio.gov/documents/Competition_Acquiring_IT_Common_Configurations.pdf The Office of Management and Budget (OMB) issued policy earlier this year requiring agencies using or acquiring Windows XP and VISTA to adopt the Federal Desktop Core Configuration by February 1, 2008. (OMB Memorandum M-0-7-11 of March 22, 2007, on Implementation of Commonly Accepted Security Configurations for Windows Operating Systems. This policy is consistent with 44 U.S.C. § 3544(b)(2)(D)(iii) of the Federal Information Security Management Act of 2002, which requires agencies to ensure compliance with minimally acceptable security configurations when acquiring information technology. This policy does not, however, limit selection and acquisition to only information technology with established security configurations (e.g., the Federal Desktop Core Configuration). Thu, 19 Jun 2008 00:00:00 EST http://www.cio.gov/documents/FISMA_Privacy_Reporting_Requirements_FY2008_M-08-09.pdf To maintain a comprehensive context for security and privacy of Federal information across government, the Office of Management and Budget is planning to add a requirement to agencies' existing annual reporting mechanisms. This memorandum provides advance notice to agencies about information which will be incorporated into the annual reporting requirements for fiscal year 2008 under the Federal Information Security Management Act (FISMA) to be issued next summer. Thu, 19 Jun 2008 00:00:00 EST