<DOC> [108th Congress House Hearings] [From the U.S. Government Printing Office via GPO Access] [DOCID: f:92900.wais] THE IT ROADMAP: AN OVERVIEW OF HOMELAND SECURITY'S ENTERPRISE ARCHITECTURE ======================================================================= HEARING before the SUBCOMMITTEE ON TECHNOLOGY, INFORMATION POLICY, INTERGOVERNMENTAL RELATIONS AND THE CENSUS of the COMMITTEE ON GOVERNMENT REFORM HOUSE OF REPRESENTATIVES ONE HUNDRED EIGHTH CONGRESS FIRST SESSION __________ OCTOBER 8, 2003 __________ Serial No. 108-129 __________ Printed for the use of the Committee on Government Reform Available via the World Wide Web: http://www.gpo.gov/congress/house http://www.house.gov/reform ______ 92-900 U.S. GOVERNMENT PRINTING OFFICE WASHINGTON : 2003 ____________________________________________________________________________ For Sale by the Superintendent of Documents, U.S. Government Printing Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512ÿ091800 Fax: (202) 512ÿ092250 Mail: Stop SSOP, Washington, DC 20402ÿ090001 COMMITTEE ON GOVERNMENT REFORM TOM DAVIS, Virginia, Chairman DAN BURTON, Indiana HENRY A. WAXMAN, California CHRISTOPHER SHAYS, Connecticut TOM LANTOS, California ILEANA ROS-LEHTINEN, Florida MAJOR R. OWENS, New York JOHN M. McHUGH, New York EDOLPHUS TOWNS, New York JOHN L. MICA, Florida PAUL E. KANJORSKI, Pennsylvania MARK E. SOUDER, Indiana CAROLYN B. MALONEY, New York STEVEN C. LaTOURETTE, Ohio ELIJAH E. CUMMINGS, Maryland DOUG OSE, California DENNIS J. KUCINICH, Ohio RON LEWIS, Kentucky DANNY K. DAVIS, Illinois JO ANN DAVIS, Virginia JOHN F. TIERNEY, Massachusetts TODD RUSSELL PLATTS, Pennsylvania WM. LACY CLAY, Missouri CHRIS CANNON, Utah DIANE E. WATSON, California ADAM H. PUTNAM, Florida STEPHEN F. LYNCH, Massachusetts EDWARD L. SCHROCK, Virginia CHRIS VAN HOLLEN, Maryland JOHN J. DUNCAN, Jr., Tennessee LINDA T. SANCHEZ, California JOHN SULLIVAN, Oklahoma C.A. ``DUTCH'' RUPPERSBERGER, NATHAN DEAL, Georgia Maryland CANDICE S. MILLER, Michigan ELEANOR HOLMES NORTON, District of TIM MURPHY, Pennsylvania Columbia MICHAEL R. TURNER, Ohio JIM COOPER, Tennessee JOHN R. CARTER, Texas CHRIS BELL, Texas WILLIAM J. JANKLOW, South Dakota ------ MARSHA BLACKBURN, Tennessee BERNARD SANDERS, Vermont (Independent) Peter Sirh, Staff Director Melissa Wojciak, Deputy Staff Director Rob Borden, Parliamentarian Teresa Austin, Chief Clerk Philip M. Schiliro, Minority Staff Director Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census ADAM H. PUTNAM, Florida, Chairman CANDICE S. MILLER, Michigan WM. LACY CLAY, Missouri DOUG OSE, California DIANE E. WATSON, California TIM MURPHY, Pennsylvania STEPHEN F. LYNCH, Massachusetts MICHAEL R. TURNER, Ohio Ex Officio TOM DAVIS, Virginia HENRY A. WAXMAN, California Bob Dix, Staff Director Scott Klein, Professional Staff Member Ursula Wojciechowski, Clerk David McMillen, Minority Professional Staff Member C O N T E N T S ---------- Page Hearing held on October 8, 2003.................................. 1 Statement of: Cooper, Steven I., Chief Information Officer, U.S. Department of Homeland Security....................................... 17 Evans, Karen S., Administrator of E-Government and Information Technology, Office of Management and Budget.... 9 Letters, statements, etc., submitted for the record by: Clay, Hon. Wm. Lacy, a Representative in Congress from the State of Missouri, prepared statement of................... 8 Cooper, Steven I., Chief Information Officer, U.S. Department of Homeland Security, prepared statement of................ 20 Evans, Karen S., Administrator of E-Government and Information Technology, Office of Management and Budget, prepared statement of...................................... 12 Putnam, Hon. Adam H., a Representative in Congress from the State of Florida, prepared statement of.................... 4 THE IT ROADMAP: AN OVERVIEW OF HOMELAND SECURITY'S ENTERPRISE ARCHITECTURE ---------- WEDNESDAY, OCTOBER 8, 2003 House of Representatives, Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, Committee on Government Reform, Washington, DC. The subcommittee met, pursuant to notice, at 10:40 a.m., in room 2247, Rayburn House Office Building, Hon. Adam Putnam (chairman of the subcommittee) presiding. Present: Representatives Putnam, Murphy, and Clay. Staff present: Scott Klein, professional staff member; Bob Dix, staff director; Ursula Wojciechowski, clerk; John Hambel, counsel; David McMillen, minority professional staff member; and Teresa Coufal, minority assistant clerk. Mr. Murphy [presiding]. Good morning. As you can tell, I'm not Mr. Putnam. His flight is delayed. He'll be here soon and I'll be starting off for him. A quorum being present, this hearing of the Subcommittee on Technology, Information Policy, Intergovernment Relations and the Census will come to order. Good morning and welcome to today's hearing on a very important information technology initiative: The Department of Homeland Security's Enterprise Architecture. This morning the subcommittee will be examining the Department's release of its first enterprise architecture as well as how it aligns with the overall Federal Enterprise Architecture and E-Government strategy. Less than a year ago, on November 25, 2002, President Bush launched this enterprise architecture development process by signing into law the bill that combined part or all of 22 Federal agencies into one Cabinet-level umbrella known as the Department of Homeland Security. As you may be aware, this consolidation is the largest reorganization of the Federal bureaucracy since our Defense Department and intelligence agencies were restructured over a half century ago. In addition to the challenges of consolidating and integrating the masses of disparate information technology systems to allow 22 agencies to function as a cohesive organization, the Department quickly discovered it had a critical and enhanced role to secure, analyze, and share important information across traditional agency boundary lines, including intergovernmentally. To achieve the Department's core mission, the need to interface and become interoperable with systems internally and externally quickly became a top priority. The Department inherited a collection of legacy systems for a variety of missions, from securing our borders to providing intelligence data identifying subjects of interest. Clearly the challenge was, and continues to be, an enormous exercise in collaboration that requires cooperation throughout the entire organization. In assessing the huge task it faced, the Department of Homeland Security discovered it operated more than 1,000 servers and approximately 700 different applications, including more than 300 applications performing some variety of back- office operations. Nearly 50 of those disparate applications have been functioning to prevent and respond to terrorist events. As we have seen during congressional debate and at hearings, the Department has faced tremendous challenges to become interoperable in unifying multiple field structures; blending the cultures of each agency and some 180,000 employees; standardizing data to improve information sharing; and integrating both existing applications and IT. Needless to say, building an effective Department from 22 separate entities will require sustained leadership from both IT and other top managers to ensure the transformation of a diverse collection of agencies, programs, and missions into an integrated organization. Quite frankly, some have expected this transformation to simply occur overnight and fail to fully appreciate the magnitude of the effort required to achieve the integrated functionality necessary to operate in a collaborative manner. The IT challenge is only part of the equation, however; the success of that component is critical to the ultimate success of the transformation itself. The challenges that face the Department are both real and difficult, in fact, leading the General Accounting Office to designate the administration of the Department as a high-risk area. Foremost among those challenges is the Department's development and implementation of a coherent enterprise architecture to support its mission. Even the President's own homeland security strategy identifies, among other things, the need for an enterprise architecture as a necessary component to achieving the goal of the Department's systems interoperating effectively and efficiently. As I am confident our witnesses will convey today, an enterprise architecture is a very important step because it will help identify shortcomings and opportunities in current homeland security-related operations and systems, such as duplicative, inconsistent, or missing information. I also understand that as part of its enterprise development efforts, the Department has established working groups comprising State and local CIOs to ensure that it understands and represents their business processes and strategies relevant to homeland security. In addition, I understand that OMB, in its examination of DHS's overall IT program, an effort to identify redundant activities that might be candidates for consolidation and integration through the IT budget submission process, has taken an initial first step to evaluate DHS's component systems. Given the climate that exists in our world today and the eminent danger that confronts our Nation, there are justifiably huge expectations for the Department of Homeland Security. Many folks are insisting upon results, and today we will examine a significant step forward in producing those results. Truthfully, it is a remarkable achievement that we are here today, in such a short period of time by virtually anyone's measure, to unveil this critical information technology milestone at the Department of Homeland Security. This subcommittee has held 15 hearings during the 108th Congress focused on e-government, integration and consolidation of governmentwide functional IT systems, information privacy and cyber security. Development of an effective enterprise architecture at the Department will provide a detailed roadmap to address nearly all of the important IT issues examined this year by the subcommittee, including how DHS will configure its IT in such functions as grants management, geospatial information, HR and financial management systems, smart cards and biometrics, records management and the handling of personally identifiable information by government. In addition, this subcommittee's oversight activities on cyber security have made it abundantly clear that developing and adhering to an enterprise architecture is the most effective method of integrating information security solutions over the long term. Congress recognized the importance of EA in assessing risk and achieving secure systems through passage of the Federal Information Security Management Act, which requires agencies to consider security throughout the life cycle of a system. Consistent with today's architecture release, we will continue to press for cyber security solutions at the initial stages of systems development versus attempting to attach expensive, disparate solutions to the old processes and systems as an afterthought. Finally, on a broader scope, the subcommittee will review how this initial Department of Homeland Security roadmap aligns with the overall Federal Enterprise Architecture and E- Government Strategy managed by the Office of Management and Budget. Accordingly, we are very pleased to be joined today by the distinguished CIO from DHS, Mr. Steve Cooper, and we welcome the brand new administrator for Information Technology and E-Government, Karen Evans, for her very first appearance at a congressional oversight hearing in her new position. I now yield to the gentleman from Missouri, the ranking member, Mr. Clay, for any opening remarks that he may wish to make. [The prepared statement of Hon. Adam H. Putnam follows:] [GRAPHIC] [TIFF OMITTED] T2900.001 [GRAPHIC] [TIFF OMITTED] T2900.002 [GRAPHIC] [TIFF OMITTED] T2900.003 Mr. Clay. Thank you, Mr. Chairman, and thank you for calling this hearing. I also thank the witnesses for appearing before us today. Unfortunately, this morning is full of competing opportunities. The full Committee on Government Reform is downstairs holding a hearing on rebuilding Iraq, and I apologize for not being able to give this hearing my undivided attention. It wasn't that long ago that information policy in the Federal Government was about buying computers. People talked about information resource management, but what they really meant was buying computers and computer software. Congress believed that information policy was about getting the right information to decisionmakers at the time they had to make a decision. That concept was a part of the last rewrite of the Paperwork Reduction Act which was written in the early 1990's. These competing concepts have come together and been named enterprise architecture. Unfortunately, it took a few billion dollar mistakes at the IRS and the FAA before the executive agencies got it. When you strip away all of the jargon, the process of developing an enterprise architecture is about mapping the way an organization communicates and making sure those communications are timely and effective. Congress put together 22 agencies from nearly every Department in the government to create the Department of Homeland Security. The managers of the Department now have the task of making those agencies work together as a cohesive whole. The enterprise architecture is designed to be a roadmap for how that will happen. Like most maps, there are a variety of ways of getting from A to B. Some routes are more direct than others. Some are more expensive and some more educational. What really matters is how the Department chooses the route it will take. Implementing this transformation is about communication and cooperation. If the individuals and agencies within the Department lose sight of those goals, the process will fail and the Department will fail in its mission to protect the American public. If this transformation becomes bogged down in selecting which personnel system will be used or which payroll system or whether it runs on PCs or Sun Microstations, the process will fail. I look forward to our discussion today, and I hope our witnesses will proceed with a minimum of jargon. Thank you, Mr. Chairman. Mr. Murphy. Thank you, Mr. Clay. [The prepared statement of Hon. Wm. Lacy Clay follows:] [GRAPHIC] [TIFF OMITTED] T2900.004 Mr. Murphy. I too hopefully will understand half of what is said. I will rely on you to understand the other half. Thank you for your leadership in this subcommittee. I ask now that the witnesses rise to be sworn in. [Witnesses sworn.] Mr. Murphy. Let the record show that both witnesses responded in the affirmative. I'd like to start by introducing our first witness for her 5-minute opening statement, Karen Evans. On September 3, 2003, Karen S. Evans was appointed by President Bush to be Administrator of the Office of Electronic Government and Information Technology at the Office of Management and Budget. Ms. Evans replaces our good friend Mark Forman, and I understand she began as Administrator on Monday; and to her great fortune, 48 hours later she's testifying before Congress. I hope you've had time to prepare. Prior to joining OMB this week, Ms. Evans was Chief Information Officer at the Department of Energy and served as a vice chairman at the CIO Council, the principal forum for agency CIOs to develop IT recommendations. Previously she served at the Department of Justice as Assistant and Division Director for Information Systems Management. Ms. Evans, thank you for agreeing to serve in this important post. We are grateful for the work you're going to be doing, and we look forward to working closely with you and your staff. Welcome, and I yield 5 minutes for your opening statement. STATEMENT OF KAREN S. EVANS, ADMINISTRATOR OF E-GOVERNMENT AND INFORMATION TECHNOLOGY, OFFICE OF MANAGEMENT AND BUDGET Ms. Evans. Good morning, Mr. Chairman, Ranking Member Clay, and members of the committee. It is my pleasure to be here during my first week as the new administrator of the Office of Electronic Government and Information Technology at OMB. Thank you for the opportunity to discuss with the committee the steps the administration has undertaken and will continue to take to improve Federal IT management, particularly as it relates to our homeland security mission. Mr. Chairman, I know that under your leadership, this committee has been a forerunner in Congress on a number of critical IT issues such as enterprise architecture, e- government and IT security. I look forward to working with you and the committee to make progress on our shared priorities. My remarks will focus primarily on the administration's Federal Enterprise Architecture [FEA] efforts as well as OMB's role in assisting the Department of Homeland Security in their enterprise architecture [EA] work. The development and implementation of the FEA is a key step toward achieving significant governmentwide improvement in the management of Federal IT resources. The FEA gives agencies a new way to describe, analyze, and improve how the Federal Government serves its citizens. By looking at the government's many lines of business, the citizen groups it serves, and the underlying tools and technologies, agencies will be better able to leverage resources while improving service delivery. We will be able to identify opportunities to eliminate redundant investments while improving integration of resources and information sharing across Federal agencies with State and local governments. This business focus framework will assist Federal agencies, OMB, and the Congress in improving the performance of the government. The outcome of our FEA efforts will be more citizen-centered, customer-focused government that maximizes technology investments to better achieve mission outcomes. The FEA also directly supports the development of individual agency's EAs by providing a framework for agencies to align their performance, business, data application and technology layers to the FEA. OMB has leveraged both traditional management and budget processes to ensure that the FEA is directly linked to and informed by each agency's EA and agency's IT investments. Each agency's EA must describe how they meet their missions through the use of people, business processes, data and technology, while each major IT investment request must detail how the investment is aligned with and supports the FEA and the agency EA. While it is essential for each agency to develop and implement an EA, nowhere is this more critical than for the Department of Homeland Security. Achieving effective homeland security will require IT investments that guarantee realtime information sharing to improve response time and decisionmaking. To meet these goals and assist in overcoming information sharing barriers, we require wise IT investments that support homeland security missions, enhance productivity and improve information sharing while providing for security and privacy. In his proposal for creating the Department over a year ago, the President highlighted the use of EA techniques. The President stated that the development of a single EA for the Department would result in elimination of duplicative and poorly coordinated systems that are prevalent in government today, and that we must fund homeland security missions based on an overall assessment of requirements rather than a tendency to find all good ideas beneficial to a separate unit's individual needs even if similar systems are already in place elsewhere. The merging of 22 previously separate agencies has resulted in DHS inheriting many redundant and overlapping IT systems and processes, nearly all designed to address individual programs. Both the FEA and the Department's EA will be instrumental in identifying opportunities for both reducing existing duplication and preventing new redundant investments. Throughout the fiscal year 2005 budget process, OMB will work with the Department to eliminate redundant and nonintegrated operations systems and processes for both IT infrastructure and mission areas. DHS's EA is indispensable to achieving these results. However, to be an effective tool, the EA must reflect organizational decisions made by the Department's leaderships and be used by the entire Department and particular senior officials in mission and management in making all resource decisions. Tough but necessary investment decisions must be made on which systems and processes remain, which will be consolidated and which are eliminated. OMB will continue to oversee DHS's efforts to implement their EA, consolidate their IT investments and support and shepherd E-gov initiatives through both management and budget processes. Through the budget process OMB will assess all DHS major IT investments with a strong focus on planned integration and consolidation of overlapping systems. Additionally, through the President's Management Agenda, under the expanding electronic government score card, OMB will assess on a quarterly basis the Department's progress in their EA development and implementation as well as their IT consolidation activities. The administration will continue to work collaboratively across Federal agencies with Congress, State, and local governments and the private sector to strengthen information sharing in support of homeland security efforts. Both the FEA and DHS's EA are vital tools necessary to improve the management and performance of our homeland security missions. While we recognize the significant challenges facing DHS in consolidating the cultural and resource legacies of 22 component agencies, we fully expect that DHS leadership will continue to build an integrated and interoperable structure. To ensure we successfully meet this goal, OMB will work with DHS leadership to ensure that their EA efforts, their integration of business processes and consolidation and elimination of redundant IT investments remains a top priority and is addressed in a timely manner. I look forward to working with the committee on our shared goals of improving the Federal Government's management of all its IT resources, including those related to homeland security. Thank you. Mr. Murphy. Thank you, Ms. Evans. [The prepared statement of Ms. Evans follows:] [GRAPHIC] [TIFF OMITTED] T2900.005 [GRAPHIC] [TIFF OMITTED] T2900.006 [GRAPHIC] [TIFF OMITTED] T2900.007 [GRAPHIC] [TIFF OMITTED] T2900.008 [GRAPHIC] [TIFF OMITTED] T2900.009 Mr. Murphy. Our second witness this morning is Steven I. Cooper, Chief Information Officer of the U.S. Department of Homeland Security. Prior to being appointed by the President to be the first CIO at the Department, Mr. Cooper served at the White House as a Special Assistant to the President for Homeland Security. Prior to Federal service, Mr. Cooper spent 20 years in the private sector, most recently as a CIO at Corning in New York. Previously he served as Director of IT for Eli Lilly & Co. in Indianapolis. He also held key IT management positions with CSC, Maxima, and CACI. Mr. Cooper, you certainly have been given a monumental task, and I know Members of Congress are looking forward to your candid views on this subject and the Department of Homeland Security. You may proceed. STATEMENT OF STEVEN I. COOPER, CHIEF INFORMATION OFFICER, U.S. DEPARTMENT OF HOMELAND SECURITY Mr. Cooper. Thank you. Mr. Murphy and members of the subcommittee, I'm very pleased to appear before the subcommittee today. I want to thank the chairman and members of the subcommittee for giving me the opportunity to talk about the Department of Homeland Security's enterprise architecture efforts and initiative. I'm very pleased to announce to you that we have completed the first version of our target enterprise architecture and are already beginning to implement the objectives of our enterprise architecture transition strategy. The enterprise architecture will help DHS align information technology investments with its mission and business needs, help us improve data sharing and interoperability with its many information sharing partners and stakeholders that include other Federal agencies, State and local tribal governments and particularly the private sector responsible for our critical infrastructure. In my previous testimony, I discussed the vision and strategy of DHS and how that strategy must be supported by a disciplined capital planning and investment control process that is guided by a business-driven enterprise architecture. Our strategy identified major initiatives, such as information integration across the Federal, State and local government, private industries and citizens, common standards for electronic information sharing and integration, improved communications capability and interoperability and reliable public health information capability and sharing. The enterprise architecture captures this strategy and describes a target information management infrastructure that will be dramatically different from the one we have today, one that will provide timely, accurate, useful, and actionable information to all individuals who require it all the time. We have accomplished something we believe to be truly unique in the Federal Government. We have designed and delivered a comprehensive and immediately useful target enterprise architecture in less than 4 months. Our enterprise architecture is enabling us to make decisions now about our information technology investments, even as we continue the hard work of developing greater detail, reaching deeper to find more opportunities for consolidation and are beginning to develop new and improved mission support capabilities enabled by information technology. Now I'd like to kind of take everything we've done and see if I can summarize it in easy to understand jargon in less than a couple minutes. Mr. Murphy. Please. Mr. Cooper. First let me share some of the things that we found. First of all, we have inherited a ton of stuff. Most of it is categorized in some manner within the legacy organization that developed it. At that time everything was developed for the mission and capability of that specific legacy entity. For example, legacy Customs, legacy Immigration and Naturalization Service, Federal Emergency Management Administration and so forth. What we have to do and what we have already begun doing-- and we have our first release--is to basically step back and now take a look in the context of the Department of Homeland Security, how do all the parts and pieces fit together. The diagram that you have on your left, which isn't quite the eye test that you have on the right--and we'll get copies of these to the committee members--but on the left you effectively have a diagrammatic representation of the strategies, goals and objectives of the Department. We refer to it as our value chain, the same as you would find in any private sector corporation. It represents what we have to accomplish to secure the homeland and protect the lives and secure 286 million Americans. It's that simple. On the right, that single diagram which we labeled a sequencing diagram effectively represents all the work that we've done in this first release. Let me try to verbally describe what you see up there. First and foremost, the value chain in that left-hand diagram is represented across the center--the rough center of the diagram left to right. So those kind of blue-turning-to-gray rectangles are the mission, goals, and objectives of the Department. I'll give you an easy example. We talk about preventing incidents, disseminating information, preparing for incidents. God forbid something should happen, we have to respond to that incident and we have to recover from that incident. At the highest level, that's the goal of the Department related to terrorism. If we then begin to break that down, what we find is a lower-level category that aligns with that mission that we've labeled threat identification and management, to give you one example for illustrative purposes here. Below that horizontal grouping of rectangles the little teeny tiny print that none of us can read are basically all of the projects and initiatives that we found underway in the Department at this time. Now, what you can visually see is some of the columns have a whole bunch of projects, and some of them have very few or none. The first thing that that tells us is where we've got a whole bunch of them, they're basically in the same mission area and may provide an opportunity for integration and consolidation. Collectively, those projects represent somewhere on the order of about $2 billion in fiscal year 2004. So we're talking a pretty sizable capital investment. Our work then, if I continue the example of threat identification and management, I'm going to read these quickly, but you'll get the idea, OK, and some of these names you will recognize. CAPS 2, U.S. VISIT, SEVS, which is the Student Exchange and Visitor System, electronic surveillance system, FORCE, IDENT consolidated intelligence system, numerical integer intelligence system, cyber warning information, national warning system. You get the idea. There are about 16 major initiatives in this threat identification and management column, and one of our first orders of business is to understand how do they integrate, how do they overlap, if they overlap, and what can we do to both successfully deliver the mission capability represented by these applications but at the same time be respectful of the fact they represent a huge investment of taxpayer dollars. We don't want to be wasteful. We want to ensure homeland security, and we may have opportunities to both consolidate, deliver mission-capable, deliver accurate, useful and timely information and save money. That's our objective. We repeat that across every one of those columns. There's a significant amount of work to do. The pink stars or the lavender stars represent what we believe to be quick hits. Those are things we believe we could do very quickly, meaning within about a 6-month timeframe, to accomplish delivering mission capability, doing no harm to current mission capability in each of our inherited legacy environments, and at the same time begin some of the consolidation activity, integration activity. At this point in time let me stop, and I think Karen and I would both be delighted to answer questions of the committee. [The prepared statement of Mr. Cooper follows:] [GRAPHIC] [TIFF OMITTED] T2900.010 [GRAPHIC] [TIFF OMITTED] T2900.011 [GRAPHIC] [TIFF OMITTED] T2900.012 [GRAPHIC] [TIFF OMITTED] T2900.013 [GRAPHIC] [TIFF OMITTED] T2900.014 [GRAPHIC] [TIFF OMITTED] T2900.015 [GRAPHIC] [TIFF OMITTED] T2900.016 [GRAPHIC] [TIFF OMITTED] T2900.017 [GRAPHIC] [TIFF OMITTED] T2900.018 [GRAPHIC] [TIFF OMITTED] T2900.019 [GRAPHIC] [TIFF OMITTED] T2900.020 [GRAPHIC] [TIFF OMITTED] T2900.021 Mr. Murphy. Thank you both for your testimony. This shows a very complex system that needs to be smoothly integrated, because where there's all that complexity, there's also a lot of places that there are chinks in the armor, so to speak, that we make sure we resolve so no one sees those as vulnerable positions. Mr. Cooper, let me begin by questioning you at the bottom line. How will the enterprise architecture that you discuss contribute to the achievement of the overall mission of the Department of Homeland Security? Mr. Cooper. First and foremost, as I mentioned, the enterprise architecture captures and represents all of our mission capability. One of the first things that we recognize is that we have to basically understand what we have today before we can add new mission capability from an information technology enablement perspective. So the first immediate value is we know what we have, we know what we need to rationalize and stabilize from an infrastructure perspective, meaning we've got to have a stable platform before we can launch new capability. From that stable platform, which we anticipate will probably take us about 12 to 24 months, the good news is that we deliver value along the way, so it's not an all-or-nothing proposition, but it will take us about 12 to 24 months to completely stabilize our infrastructure. We then can launch new mission capability along the way, but we can rapidly speed up, we can make wiser investments of how we want to achieve new capability. We can understand where we are lacking support for some of our mission capability. We can identify that immediately, as I mentioned, by showing basically the white space in our enterprise architecture. Mr. Murphy. As a followup there, when you talk about things you can do within the first 6 months, are those things you can do within the first 6 months because they are relatively more simple to change or because those are high priorities? Mr. Cooper. Both. Mr. Murphy. Let me followup by asking you to describe for this subcommittee how a comprehensive architecture will produce a Department that is more efficient, productive and cost effective. I think you're talking about $2 billion worth of programs here. Mr. Cooper. Exactly. You had already mentioned in fact in your opening remarks that we've identified, for example, over 300 information technology solutions and applications that are what we call back-office in nature. They represent the functions around human resources, finance, budgeting, procurement acquisition capability. While I can't argue that necessarily one or two is the right answer, I can tell you 300 is not the right answer. All right. So one of the things that we can immediately do, and we have now identified these, we can immediately begin to stop or not continue some of the redundant applications, guided by the principle of doing no harm. We need to make informed decisions about where we stop, and we will do that. We'll do it conjoint with OMB. We'll do it with this committee and with Congress as appropriate. But we can begin to move from many, in this case 300, down to some sizable, manageable number. That enables us to take the savings that we will achieve in this integration and consolidation and apply that to other areas of need. The idea would be hopefully that our efforts do not cost additional money, but rather we are able to redirect where we invest. Mr. Murphy. Let me followup with that. You're going to integrate 22 agencies through all this. So I mean, what is the real effect going to be on DHS in accomplishing its overall mission of utilizing your enterprise architecture here, getting these 22 agencies together? Mr. Cooper. Let me give a couple more specific examples in the mission area. The principle that we're after is basically to simplify our environment. OK. We want to make things less complex, but at the same time deliver mission capability. In the mission space we've already identified areas of opportunity. One I shared with you around threat identification and management. Another one that we've begun to do work in is identity credentialing. We have several applications underway that deal with the identification of people and how they are documented, how that documentation is then authenticated. By first identifying all these different initiatives, we can take a look at where they overlap, we can begin to bring multiple project teams that began in their legacy environments, meaning the Coast Guard had different initiatives underway, the Secret Service had different initiatives underway, legacy Customs, legacy INS, all had appropriate to their mission initiatives underway. By bringing those teams together and by having them work with one another, we accomplish a couple very important things. First of all, we rapidly integrate the actual functionality to deliver mission capability of the Department. We now have people with expert skills in this area or other areas working so that we speed up the process by which 190,000 people begin to know who to talk to and who to collaborate with inside the Department. Extremely important and extremely valuable for us to do that as quickly as we can. The second thing, we begin to leverage that expertise. Each one of those experts brings their expertise and their perspective from the objective that they previously operated in, their previous operating environment. By sharing we benefit as a Department because now we have a broader perspective. The United States benefits because we now are bringing many experts to bear on common problems, and we can do it faster. Hopefully we can do it less expensively, and we can achieve a result that is basically greater than the sum of the parts. Collaboration, knowledge management, identity credentialing, intelligence information, integrated case management are all other examples of areas of activity that we're bringing collective project teams and initiatives together. Mr. Murphy. You were talking about the legacy and what appears to be redundancy, but are these functions that different from one another, or are they going to want to preserve some of their turf on how they handle this? Mr. Cooper. Well, let me answer in two parts. First of all, from a process and functionality standpoint, there is overlap. Let's take something like the identification of people who might be a threat to the United States. We can do the same thing with the identification of cargo, in tracking cargo before it reaches our ports of entry. Secretary Ridge has announced that is our Smart Border Initiative. In both of those cases there clearly are aspects of each of those processes that we want to retain within the inherited legacy environment, but there are also aspects that we absolutely want to share. Now, the second part of the question about are there cultural objectives to overcome, candidly I would tell you, yes, there are. We have some parts of the Department that have a 200-year-plus very rich history and legacy of tradition and honor and service to America. We don't want to do away with that. We don't want it to disappear. This is about change. This is about organizational change. This is about people understanding how do I continue to have a valued role in a new working environment, which is now the Department of Homeland Security. That's tough. It requires each of the individuals involved to understand how they have to contribute in a new role. It does require some very hard work with regard to organizational entities and how those entities cooperate and work together. Mr. Murphy. So how confident are you that the content of this whole EA program has sufficient depth and scope to address the intended purposes here? Mr. Cooper. At the moment it does not have sufficient depth. What we explained and what I shared in my testimony back in the April timeframe was that we will continue--this is a living, breathing type of initiative. It's dynamic. We will continue, and have already begun on effective release of two of our enterprise architecture. That is, to continue the work that has begun and now push it both down in level of detail and fill in some of the gaps, some of the white space that you see that we weren't able to address adequately in our initial 4 months. I am very confident that the process of enterprise architecture as defined by OMB and as now applied by DHS will deliver all of the level of detail granularity, understanding, business goals, business-driven linkage that we will need. It will take us a little bit more time to fully populate the enterprise architecture, but the important message is we are using our enterprise architecture now to make decisions about IT investment. We will continue to do that, as it becomes more robust. Mr. Murphy. Ms. Evans, I know it's Wednesday and you pretty much have to grasp the entire program you've inherited Monday, but actually I wonder if you could also comment on OMB's perception of this. How and when do you think you'll have a grasp of the sufficient scope and depth of this EA program from OMB's perspective? Ms. Evans. Well, the only perspective--and a preliminary review of the Department of Homeland Security's EA efforts, we believe is really very encouraging. We are pleased that they have identified a current state enterprise architecture as well as a target state and a transition plan. We are also very encouraged with the clear linkage that they have to the Federal Enterprise Architecture efforts as well as their commitment to a component-based approach for application and integration. What we will be evaluating as we go forward are the investment decisions that they are now making, and it will be reflected in the President's budget for the fiscal year 2005 budget. Mr. Murphy. One thing that certainly struck us with this new Department is it's not the same kind of discussions held back in the 1790's when forming departments to begin with, but part of where we are now is we're looking at evaluation metrics and how one will put some things in place to evaluate what is going on. Mr. Cooper, what is being put in place? Mr. Cooper. We use two high-level metrics, kind of from the startup of the Department, because obviously we hadn't had a chance to get together. We hadn't had a chance to get guidance from the Secretary and business leadership yet, but we immediately put two metrics in place. One was speed to market or cycle time. OK. We set that as a metric, because we felt that it held value almost across every business process of the Department. If there are activities that we can do, if we can take out nonvalue-added work in our business processes to reduce the time, for example, that critical information, homeland security-sensitive information gets from its source to sworn law enforcement officers as an example, then in fact we are moving to increase the security of the United States. The second metric that we have applied thus far is the quality of the information that's used wherever it's used throughout the Department. By focusing on cycle time, speed, and quality of information---- Mr. Murphy. Those are the metrics you're using? Mr. Cooper. Those are the two metrics that we're using right now, OK. We felt that immediately added value. What we intend to do and what we've begun now, as we now continue the in-depth work and based upon the data that we've gathered thus far, we now can begin to actually attach specific performance metrics to each of the mission areas of the Department. So, for example, if we look at the cargo area, we can actually now begin to use the information gathered to determine an easy one: how many containers that we believe might hold risk are inspected. OK. Today that percentage is not very high. It isn't that we want to move to 100 percent inspection, but we want to move to 100 percent of those where we believe there is sufficient risk or the informed information we have leads us to believe that we ought to inspect that container. Mr. Murphy. Are you talking about imported containers? Mr. Cooper. Yes. In that example, imported containers. Mr. Murphy. But what about packages shipped within this country as well? Mr. Cooper. Again, as appropriate, what we would want to do is use the enterprise architecture information that we gather-- remember, the information is gathered from subject matter experts in all of our business areas. This isn't an IT activity, an information technology activity. It's a business- driven activity. So by participation of the business experts in each of the component areas, they are the folks who then in a facilitated manner can determine here are the performance metrics that we want to use. One of the questions that we have in the Department that we're working toward is how do you measure the success of the Department--is it as simple as no terrorist incidents, or is it more complex--so that we understand kind of the correlation and cause effect of the activities taken by the Department to prevent any type of incident. We believe it's the latter. Mr. Murphy. Are you working with private business in the same aspect too? Are we talking about just intragovernment agencies here? You talked about 22 agencies. Let's look at packaging from the shipping companies from the Postal Service, UPS, FedEx, coordinating with those efforts as well. Mr. Cooper. Absolutely. Now, in that particular example that you gave, we have a major initiative underway that you may be aware of called ACE. If I translate the acronym, it's basically the former Customs modernization effort which is now Customs and Border Protection. That initiative we are working directly with private industry. In fact, there is a supporting network, the trade support network, that is comprised--I believe its membership at any given point in time represents about 150 private sector entities and associations. They actually work directly with Customs and Border Protection to determine requirements, and those requirements then move through a release management process. They are vetted both internally by the Department and with our industry partners to determine the priority, the sequencing, cost, business advantage, that type of thing, such that they then drive additional capability that appear in subsequent releases in our modernization effort. We are doing a similar type of thing in many areas of the Department. We recognize the responsibility that the Department has to both partner with and draw upon the private sector, for we view them as stakeholders, we view them as customers, we also view them as important suppliers of a lot of the solution sets that we need to put in place. Mr. Murphy. For both of you, can you give some immediate uses, benefits? And when can we expect to see some concrete results as a result of this whole transition? Ms. Evans. As it relates to DHS, this particular effort? Mr. Cooper. Oh, I shouldn't have put you on the spot, should I? Ms. Evans. That's OK. I would like to say that as I move forward, given that this is my 3rd day, the way that we're moving forward with this so that you can--and I'd like to come and really speak more specifically to this--is that we intend to evaluate DHS going forward through the budget process and ensure that they continue on that progress through the score card initiative that OMB has, the President's management agenda score card. But we're working with DHS, just as we work with all the agencies, so that they really can realize the potentials and the results of their efforts as they move forward and make those decisions using the enterprise architecture. Mr. Cooper. Let me give you one example that's not quite as glamorous, that's not quite as sexy as some of the things that we get involved in, but it's critically important, and it deals with records management and document management. OK. One of the things that we have recognized--and with headquarters when we stood up a new headquarters, there was nothing, there was no legacy anything that we inherited. Our enterprise architecture helped us identify existing records management capability, existing document capability that we could immediately draw upon and begin to apply at the headquarters level. So while not very glamorous, it's a very real example where rather than going out and reinventing the wheel and rather than reaching out and saying, oh, we have this need in a vacuum, we'll just go ahead and move forward in this direction, we actually use the enterprise architecture to draw upon expertise and understanding what we already had available inside the Department. Mr. Murphy. I yield to Mr. Clay for some questions. Mr. Clay. Thank you, Mr. Chairman. Mr. Cooper, this enterprise architecture document is quite lengthy. At the same time it does not address what many experts say is the most important variable in any merger: agency culture. The culture at the Secret Service and in the former Federal Emergency Management Agency could hardly be more different. How will you address these cultural differences in implementing this enterprise architecture plan? Mr. Cooper. One of the things the Secretary has clearly stated is that we want to respect and retain the cultures and the traditions of the entities that now comprise the Department of Homeland Security. The value of our enterprise architecture in one sense is that it actually is an objective way to take some of the emotion out of some of the cultural aspects of how we come at things. Each of us brings our own perspective to bear on any type of problem or any type of challenge that all of us face in our professional careers or within our roles and responsibilities. The enterprise architecture being devoid of a motion actually can objectively document here's the process that we are trying to deal with or trying to automate or trying to improve. Everybody can see it. Everybody can see themselves and their perspective in our documentation of that process. Second, we clearly document this is the information that is needed, both as input to that process and perhaps produced by any particular process within the Department. All right. We can agree factually on what information is needed, what information comes out, what information flows through the process, who needs to receive that information, when do they need to receive it, in what form do they need to receive it. All right. By kind of breaking this down step by step, we don't eliminate or negate culture, but we allow all of us to have a common frame of reference with which we can bring the best that all of us have to bear on the appropriate problem. We then can step back and again in the same objective manner collectively reach consensus around, now, how do we want to automate the process and the delivery of information. Mr. Clay. All right. And in practice that's working. Mr. Cooper. In practice we're underway. Mr. Clay. Let me ask you, it's my understanding that this is just version 1 of the architecture and that you expect to develop subsequent versions in the future. What does this version represent, and what will it allow you to do? Mr. Cooper. OK. This version represents--think of it this way. We're starting top down, meaning we started with the National Strategy for Homeland Security. It's pretty high level. It's a pretty macrotype of strategy. We're trying now to push the level of detail down in terms of functional responsibility, in terms of business processes that carry out the mission, in terms of the information that supports all of these business processes; but I've given some very real examples that we have begun to identify even in this first release. So there are things that we can do, documentation management being one. OK. Those little pink stars, which even I admit I can't read from here at the table, but if I got up and ran around there, so those pink stars represent about a dozen very real opportunities that we can act on right now. Now, the banding which most of you can see, the darker blue at the bottom, represents about a 6 to 12-month timeframe. That lighter green as you move up the chart represents about a year to 2 years, and then that lightest color at the very top represents about a 2-plus-year timeframe. OK. And you'll see those little colored boxes out there. So even in this first pass, even in just the 4 months of work, we actually have begun a roadmap that says here are the things that we can do in each of these timeframes to add real value in the respective timeframes. Mr. Clay. What will--that takes me to the next question. What will version 2 add to this architecture? When will we see it, and what will version 2 allow you to do that cannot be done within this version? Mr. Cooper. OK. What we don't have here is all of the level of detail about how the processes actually operate and some of the lower level details, meaning some of the activities and tasks of how the processes are actually carried out. That will come in subsequent releases, meaning we'll continue to populate, we'll add more detail. That work becomes more tedious, it's a little bit more time-consuming, so we don't--the first 4 months we kind of-- think of it this way. We went kind of about an inch deep and a mile wide. All right. Now subsequent releases, we start going deeper and deeper and deeper. So the breadth of each release may be less, but it's greater detail. That enables us to actually understand in more detail and make more definitive decisions about how information actually fits together; where, for example, might we source once in the entire Department information about employees for human resources purposes, information about cargo for use by all business processes that must use cargo information. OK. Visa information, for example, we might with this additional detail--we could determine how do we source it once, meaning capture it once, reuse it many times across the Department. Mr. Clay. Thank you for your response. Ms. Evans, one of your stellar achievements at the Department of Energy was the contract with Oracle that incorporated security into the software contract. I'm interested to learn of your plans to expand this program. Do you expect this to become a feature of the Smart Buy Program? Ms. Evans. First, I'm very proud to speak about that particular effort at energy. What we really did was leverage our business requirements and work that into the contract so that we could ensure that what we needed to do at the Department really move forward to ensure our cyber posture. It is my intention to bring that feature where it is applicable to the smart buy activities. It was applicable in this particular case given this type of software and the applications that the Department was doing to incorporate that into the contract. Not necessarily all efforts that will be going through the smart buy would necessarily need to have that type of feature, but it is my intention to ensure that feature in support of the national cyber security strategy is incorporated into the smart buy activity. Mr. Clay. Wonderful. Wonderful. Let me also ask you, as the Federal CIO you face many of the same problems that Mr. Cooper faces, but your job of defining a common mission is even greater than that faced by Mr. Cooper. Creating common enterprise architectures across the Federal Government is a formidable task. Do you have any recommendation for Mr. Cooper as he tackles this task at the Homeland Security Department? Ms. Evans. And that is the big question. Mr. Clay. I realize you're new here but---- Ms. Evans. That's OK, and actually I really believe that as my esteemed colleague moves forward and as I move forward with my role changing, that the enterprise architecture--and you really did hit on the issue, which is it really does facilitate communications on all levels throughout all management in government, and that this effort really is about leadership with partnership. And so I really am approaching this going forward as it's a partnership between the agencies, with Congress, with private industry, State and local government, and so that we can provide that so that the result of the architecture efforts and the resulting investment decisions will really benefit the country as a whole. And I make that recommendation to Mr. Cooper as I do all my fellow CIOs. Mr. Clay. Thank you for that response. And thank you, Mr. Chairman, and so good to see you. Mr. Putnam [presiding]. Thank you, sir. It is good to be here. The airline gods have been working against me all day. Got a baby due at home and fog at National Airport. So between that I have been to Richmond and back and refueled and all that fun stuff. And I want to apologize to the two of you for being late. I am glad we are able to move forward. Ms. Evans, I want to take the opportunity to welcome you to your new position and thank you for your time and attention to this subcommittee. Your predecessor, Mr. Forman, was a frequent flyer with our subcommittee, and we have reason to believe that you will be as open and accessible and available as he was; and we are delighted to see you in that role and look forward to working with you in the future. And, Mr. Cooper, we don't envy the position you have of assimilating all of the different systems and agencies and cultures that you face. And we look forward to being partners in that effort to bring about the change that I think everyone in Congress envisioned when supporting the creation of the new department, and work together to make that a seamless transition for the best interests of homeland security and the taxpayer. If I may, I will continue with some of the questioning that Mr. Clay and Mr. Murphy have begun. Ms. Evans, I am curious how OMB, how aggressively you intend to enforce compliance with the Federal Enterprise Architecture. That is an area that certainly is a responsibility that is on your shoulders. And some is on Congress' shoulders to stand by this and be tough, but I would like to hear your thoughts on your ways to enforce compliance. Ms. Evans. Well, it is the intention of OMB and through the budget guidance that was issued this year to the agencies to align their architecture efforts with the FEA. That is our intention through the management processes and the budget processes that exist that we will assist the departments in ensuring that alignment is there and that the architecture is used for business investment decisions. Mr. Putnam. Have any discussions taken place within the agency about holding up spending and working with the appropriators to make sure that is not bypassed? Ms. Evans. Since this is my 3rd day, I would like to take that one back to find out specifically what the details are. Because I do know there are ongoing efforts within OMB, but I would like to get back to you about exploring that opportunity of how we can partner and be able to ensure that these investments, especially where DHS is concerned, are made wisely. Mr. Putnam. I appreciate that, and that is a discussion we need to have because it is important that somebody be the bad cop; and it's important that the communication take place with Congress to make sure there is not an end run, and we don't undermine your efforts on one hand or allow somebody to back- door those efforts. And I'll take that answer as the answer to my next question also, which was, how are we going to incorporate each individual agency's enterprise architecture into the overall plan and link that into their IT budget submissions? So if you would like to elaborate on that, you can. Ms. Evans. Primarily, it will be using the existing processes that are in place by managing the management processes we have in place and the budget process. Progress guidance and--is issued through the budget process. However, ensuring that progress is made is happening through the quarterly scorecard reviews that each agency has through the President's management agenda, more specifically the expanding E-Government Initiative. There are specific milestones that we do work with each agency to ensure that they make that progress and that they are aligned. Mr. Putnam. Well, it is important to make sure that the existing management processes are enforced, but I think personally, based on the information we've collected from previous hearings, that there may be additional processes required, because there have been some breakdowns in the current processes that didn't work. If you look at the smart card programs or some of the other things that we are trying to tear down, stovepipes on the left hand, and the right hand is building them back up. And that's a discussion that will be ongoing, without a doubt. In July, we held a hearing to review the efficiencies associated with consolidating and integrating the functional business systems, particularly HR, finance data, criminal investigations and so forth. And you have mentioned, each of you, in your testimony some quick-hit IT investments that you plan to pursue. Could you expand on that? And I will begin with Mr. Cooper. Mr. Cooper. We can. One of the things that our enterprise architecture, even our early work in this Release 1, helped us to begin to understand was that in some critical mission areas--and I mentioned this before you joined us, so let me quickly repeat these key category areas. These are labels. These are just working labels inside the Department that help us categorize things, but we talked about a family of applications related to identity credentialing. We talked about a family of applications and issues relating to risk and threat assessment. Another family related to intelligence information: how we gather and produce information, intelligence products, use them within the Department, move appropriate level of secure, classified and unclassified information out to the various stakeholders and constituents that need that information; integrated case management, collaboration, knowledge management, information presentation, data visualization, those types of things. Those are all families we identified as areas of opportunity for consolidation, potential areas, OK? We are not automatically saying that everything becomes one, but by using our enterprise architecture and linking it to our investment process, we were able this year, even in the short period of time of the standard for the Department, we have actually written and submitted to OMB consolidated exhibit 300's. Rather than having, for example, 20-some independent projects and/or applications move forward, each with its own business case and justification to OMB, we wrapped them together and said, wait a minute, these are all the same family; let's write a consolidated business case, let OMB know that our intention is not to violate any rules or regulations or laws or anything, but our intention is to look at these holistically and ask OMB, help us do this. OK? The same request would come to this committee and to the appropriate committees of Congress to say, hey, look, allow us the opportunity to take this type of look. One of the challenges in doing this is that many of the initiatives that are under way are--the funding is appropriated independently. So we need to cooperate, we need to collaborate to do the right thing. It's going to take all of us working together to appropriately integrate and consolidate. Mr. Putnam. But before we go to Ms. Evans on that, do you have the flexibility that you need? In a herd of horses, DHS is clearly a zebra. I mean, you are a new creature, recently developed by the Congress, trying to amalgamate all these different agencies, different systems, different legacy systems, different HR systems, different applications. Do you have the ability in the existing statutory framework and OMB or internal executive branch framework to do the things you need to do, to move people around, move resources around to assimilate those systems? Mr. Cooper. Thus far, I believe we do. Understand, of course, we're doing it as I give you the answer, and we are continuing to learn. I think what we would ask, certainly, is if you'll allow us a little bit of continued learning time. We believe that we have all of the appropriate statutory authority necessary to accomplish the mission, goals and objectives of the Department. If you'll allow us a little bit more learning time as we apply them because, remember, this is now the first full fiscal year that we have headed in as a department. It's the first fiscal year we have had a little bit of input into a full budget process, if you will, and even that was kind of constrained and allow us to come back and offer guidance from that learning over the next several months, I think that might be more helpful. But thus far, we believe we are under way and we believe we may be able to accomplish everything we need to accomplish thus far. Mr. Putnam. That's certainly a reasonable request, but just understand that you're operating on a narrow margin, considering the nature of your mission and Congress' very strong desire to see a seamless transition that is as short as possible with everybody pulling in the same direction. And from the IT side, there's probably an awful lot of people in the government who would like to see you fail to amalgamate all these systems and that you'll eliminate all of their excuses for not being able to do it. Because if DHS can pull it off, there's no reason why everybody can't really make this thing work. Ms. Evans. Ms. Evans. My predecessor did previously brief on lines of business opportunities. And so, as you asked about some quick hits in there, the work continued on the lines of business analysis, and it continues on for four specific lines of business, which is criminal investigations, public health, financial management and human resources. The one quick hit that was identified through the analysis dealt with data statistics, and that effort has moved over to the Smart Buy Initiative, where it was identified we could truly leverage the buying power of our agencies that are involved in statistical analysis and move forward to get a quick hit as far as realizing benefits of purchasing statistical packages for those groups. As far as the other four initiatives, I'd be happy to followup with the committee and provide additional detail on the current status as it moves through and completes through the budget process this year. Mr. Putnam. That would be very helpful. You're probably familiar that I sent a letter to GSA about an opportunity to realize some immediate savings in the relicensure of software. Could you give us a status report on where that is? Ms. Evans. We are currently, based on the letter that you sent, relooking at the opportunities so we can move forward; and I am in the process right now of looking at opportunities that GSA has provided in response to your letter. And, again, I would be glad to come back and talk to you in further detail about what actions will be taken so we can realize the benefits of the Smart Buy program. Mr. Putnam. Absolutely. I think it has tremendous potential. Mr. Cooper, who is the person in the Department actually responsible for holding the business owners accountable for implementing the business transaction strategy? Mr. Cooper. I think it is a shared responsibility. I have direct responsibility for ensuring that we develop and use departmental enterprise architecture. I need help, quite candidly, from all of the senior leadership of the Department. The enterprise architecture, as I stated previously, is not an information technology initiative, it is a business initiative; and therefore, I need the help and support of the Secretary, the Under Secretaries, the appropriate agency and bureau heads in order for all of us to be successful in this endeavor. But I am the person who is held accountable. Mr. Putnam. Ms. Evans, coming from the Department of Energy, the last zebra to lose its stripes, what lessons learned from DOE can be applied to the newest department in government? Ms. Evans. There are a lot of opportunities in that I think that the management team and the partnership moving forward is really key. And based on my new role, I know DHS is committed to the mission overall. The enterprise architecture was truly an effort that we really used. Again, it is leadership with partnership. It's not necessarily leadership through ownership of any of these types of things, but it is really leadership through partnership. As you use the enterprise architecture and you move through the steps, it really does, as my esteemed colleague pointed out, remove the emotion from the situation where people really are committed to making good sound investment business decisions and ensuring that the dollars are invested wisely; and the architecture provides a method for that communication to occur. That really is what happened within the Department, and I would say that I had a wonderful Secretary and Deputy Secretary who were committed to the President's management agenda and really realizing the full benefits of what can be achieved through proper, sound information technology investments. Mr. Putnam. Mr. Cooper, how often do the highest level IT persons in each of the 20-some-odd agencies that have merged into DHS get together and swap ideas and communicate? Mr. Cooper. We do that formally on a weekly basis. I established the Department of Homeland Security CIO Council almost a year ago, even before the Department was established, even though it wasn't called the DHS Security Council at the time. We have been meeting on a weekly basis for that period of time. That council is comprised of the CIOs of each of the component agencies that came into the Department where there was a named CIO. We didn't exclude anybody--small, large didn't matter; everybody is a member. We have augmented that with some additional key senior leadership in IT. We use that group in a couple of different ways. First of all, we absolutely meet to share. Our whole goal is to create a single information technology-coordinated function in support of the mission of the Department of Homeland Security, and I'd argue that we are, in fact, well under way in achieving that type of goal and collaboration. Second, that same council, reconvened in a formal manner, becomes the first-level review process of our capital planning and investment review process for the Department. So for all information technology investments, we're the first step. So that initiative will come before us and we meet then as the enterprise architecture board, same membership, to pass and enforce compliance with the enterprise architecture. Mr. Putnam. As you know, this subcommittee has done an awful lot on cyber security. If you would, please comment on how security is addressed in DHS-EA. Mr. Cooper. You'll actually see it. If you get up close enough to this thing, you will see the appropriate parts of the information security. But in addition to evolving it as an integral part of all appropriate business processes, particularly with regard to our classified host of processes and information, we have a formal information security program headed by our chief information security officer, Robert West, inside the Department. He has already established an information security advisory board that is comprised of the information system security officers and information security managers of every component of the Department, including the smaller agencies that didn't--that got that from their parent departments. They actually now have designated DHS individuals inside the Department. They meet on a regular basis, usually not lengthier than monthly, to not only address all information security policy issues, the compliance thereof, any type of reporting, such as FISMA, that we have recently completed our report out to you and to OMB; but they also serve to coordinate all of the processes that look at building--as we have mentioned, both Karen and I, building information security into all of our initiatives, not kind of pasting it on or tacking it on after the fact. Mr. Putnam. Ms. Evans, perhaps you would like to comment on the role of security in the Federal Enterprise Architecture. Ms. Evans. And I would be happy to do that, sir. Cyber security, right now, through the work of the Federal CIO council on the architecture subcommittee, there is an effort under way that is specifically dealing with cyber security to ensure that it is integrated throughout the models that are being produced that support the Federal Enterprise Architecture. So it is not going to be a separate entity or a separate model unto itself, but each model comprised and rolled up into the Federal Enterprise Architecture will have a cyber security element to ensure that every decision, everything that we go forward with that cyber security is adequately addressed to ensure the cyber posture for the Nation. Mr. Putnam. Thank you. We have had our share of worms and viruses this year. And my understanding is that 90 percent of the Federal Government is a single operating system, the same one. And so while we talk about not building more stovepipes on the one hand, there is this concept out there of monoculture, of a particular vulnerability that wipes out the entire enterprise. And I am curious how we work through those issues with regard to the Federal Enterprise Architecture. Knowing the vulnerabilities that are out there, knowing that it could be exacerbated by having the vast majority of the Federal enterprise on the same operating system, how do we guard against these worms and viruses and issues that will only grow worse and more rapid as time goes by? Ms. Evans. When we look at that and look at the worms and viruses that are going forward, it really comes down to configuration management and how each entity moves forward and deals with configuration management. And as OMB moves forward and works with each department and agency, most of these situations, when you look at them--and I can speak--I will step back into my DOE role, when we did the analysis in the past year of things that occurred within the Department. They were all related to, if we had patched in a timely and appropriate manner, that we would have avoided that situation. So this really does come down to being able to ensure that patches are applied in a timely manner and that good configuration management processes are in place within each department. Mr. Putnam. And how quickly is information on the latest patch disseminated throughout the Federal Government right down to local case work type--the local Social Security offices around the country and USDA offices and bases around the world? How quickly can we get the word out and have reason to expect and hold people accountable for applying that patch? Ms. Evans. I would say currently--I still sit in as the vice chair of the CIO Council, so I am aware that my predecessor has also briefed on that particular area. But we have moved through the Federal CIO Council to put procedures in place so the dissemination of that information happens very quickly through cooperation, and also with the efforts of FedCIRC over at DHS; so that then there is a process that's in place within each department that then makes sure that information gets disseminated to all the appropriate sources for the patching. As far as how quickly that occurs within each agency, I would be glad to go back and get more information on that and brief the committee; because OMB did collect that information from each agency, and so I would be glad to discuss that with you in further detail. Mr. Putnam. Since you have it, yes, I would be very interested in knowing to what extent enterprise-wide we're actually applying the patches that are available. I mean, undoubtedly it's just like business or home users or anything else, people don't want to fool with it, they don't think they need to, they don't think it applies to them, they don't think that they'll get it, they don't feel like stopping what they're doing to do it. All the same human issues that go into the private sector apply to government and perhaps even more so. So it would make sense the same reluctance that exists in the private sector would exist in the government, and I would be curious to know how effectively we have ingrained the importance of adequate patch management and rapid response to that. If you would, though, comment on the fact that is such a high percentage of a single operating system. Is that a concern? Is that a nonissue? Elaborate on that if you would. Mr. Cooper. Can I jump in? Mr. Putnam. Certainly. Mr. Cooper. I think for us--let me answer it this way. For us, when we took a quick look across the inherited components of the Department, particularly in kind of a desktop space, what we saw was that about 80 percent of our inherited environments were a single vendor. It was a very easy business decision from an economic standpoint to say, OK, in that space, for the time being, let's go with what we have. The costs of changing would have been prohibitive. It also would have led to very serious concerns about the abilities to sustain mission capability from day one. However, having said that, we are paying a lot of attention to the security vulnerabilities of that particular operating system environment. We are, within the Department of Homeland Security, very actively encouraging a heterogenous environment, particularly in our mission application space as opposed to desktop type of space. So as we have mission-critical applications, we are taking a look at what is the environment we want to put that particular application or application hosting in. We do have a lot of inherited environments that are not that same particular vendor; and we will not only continue to support, but probably expand some of that capability in a Unix environment or a Linux environment because we think that is highly appropriate to what we are trying to accomplish in the Department. We want to do no harm to mission capability. We want to do it in an effective and economic way. And we want to do it so if we need to migrate, we are migrating in a way that is cost effective, rapid, and again, does not harm the delivery of mission capability. Mr. Putnam. That's a very helpful response. I have no hidden agenda in the question. I am the guy that just wrote a letter to GSA demanding to know why they are not standardizing this stuff. I just recognize that there's a line where the economic incentives of a common vendor and common applications are superseded by security concerns, and that's an art and not a science, and that's why we pay you the big bucks to decide where that line is, but I am not being critical of any vendor at all. As long as human beings are going to be designing and developing this stuff, there will be problems. But there is certainly a vast opportunity in the Federal Government for nonmission-critical desktop applications and things where there are tremendous cost savings to be realized and certain niche components in agencies like yours where you want redundancy. And so I think that's perfectly appropriate. Ms. Evans. I would like to say, sir, that even if it is a single operating system, any type of approach as we go forward--and I would really like to get back to configuration, it is a risk-based approach that all of us take in moving forward and assessing the risk; how quickly and how can we apply resources to ensure that things are properly patched. Technology does exist where, regardless of what the operating system is, you can automate the application of the patch and then move forward. So as we move forward to whether it's standards-based or a single type of operating system or the known operating systems that we are managing in our environments, technology exists so that we can look at how we can apply our resources the best way that we can, automate the things that can be automated, such as patch management, and then allow those resources that we have, the scarce resources that we have that are doing these daily operations to really be focused on the high-level, mission- critical operations and ensuring that those are adequately secure as we move forward. Mr. Cooper. If I may add one additional thought, and I don't mean this to be as controversial as it may end up sounding. Mr. Putnam. Choose carefully. There are a lot of pens and pads in the room. Mr. Cooper. But, I mean, this in a constructive way. Patch management is something that we have to do because of what we're dealt. We have entered into conversations with this particular company that none of us are naming and had some very serious and candid conversations about, Look, realistically you have to improve the quality of your product relating to information security. It's that simple. Karen is absolutely right. We have invested a significant amount of time and energy and people's, you know, resources and expertise and everything in configuration management, in patch management. But I also argue that we could lessen the need for that if we worked cooperatively and collaboratively with some of our major vendors to produce quality product that doesn't have quite so many vulnerabilities in it. Mr. Putnam. Well said. And certainly the purchasing power of the Federal Government would be a powerful incentive to improve the quality of any particular vendor's given product. As long as we are willing to buy products that are not to the standard that they should be, people will continue to sell those to us. Both of you have been down in the trenches and have seen the Federal Government's IT enterprises at the field level, and you understand, certainly better than anyone on this subcommittee without a doubt, the real-world cultural differences. As you have assumed these new major positions of responsibility, what are your thoughts on ways to break down those barriers and really have effective information sharing, effective cross-agency coordination and cooperation? Mr. Cooper. I think, from my perspective, one of the biggest challenges is kind of--I guess it's communication, meaning getting the right folks in one room at one time to have the type of conversation that really then almost always enables us to reach the type of collaborative decisions we need to make. And I'm not sure that's anybody's fault. Right now in the Department we have so much coming at us, we're literally trying to change the tires on the car while it's moving 70 miles an hour. We're still staffing, meaning we're still trying to hire folks into some of our authorized positions, things like that. So getting quality time with some of the key people to address many of the challenges of information sharing is difficult. I mean, it is a very real challenge. It's not because anybody is trying to do the wrong thing. When we are able to do that, we're actually able to reach consensus and move forward rather quickly. But doing that first within the Department of Homeland Security, then doing it among and between the Department and other Federal agencies, then doing it with each of our stakeholders--it's a numbers game. There are 56 States and territories. We have a State homeland security coordinator in each of the 56 States and territories. That one is easy, and we have regular conversations with those folks a couple times a week. But if we then try to reach out and collaborate around information sharing with, for example, counties, there are 33,000 counties. I don't know how to do it, I admit. I don't know how to get exactly the right representation. How do we collectively pull all these folks together? There are 89,000 municipalities at the local level. Now layer on top of that the five major sectors of the emergency responder community or the first responder community. Our struggle is, how do you get the right people together to have the discussion. Mr. Putnam. Well, you've done an outstanding job of laying out the challenge, but I would just respond to that by saying the primary purpose in your Department's creation was information sharing. I mean, all the functions of the Department of Homeland Security were already there, but it was a breakdown in information sharing that allows bad guys to fly in on airliners and allows bad guys to cross the border and allows bad guys to smuggle bad things in the bottoms of ships. So I view your role in the Department of Homeland Security as being the most critical. That was the reason why I voted to create it. We are not going to save any money in the near future. We hope to in the long run, but it's going to cost us more in the short run to merge all this stuff together. It was the fact that one file wasn't being transferred from one desktop to another desktop. It was the fact that people in one border guard station weren't talking to the one right next to them, and they were wearing separate uniforms at the same time. It was that information sharing, I think, that led the Congress to make that leap. And so it's vitally important. I know that both of you have other engagements and need to leave very shortly, and I can't hold it against you since I was an hour and a half late getting here myself. I will give you the opportunity at this point in the meeting to express whatever is on your mind, and you think is important to go in the record and for the subcommittee to hear. And as you embark on your 3rd day on the job, we'll give you a few more moments to collect your thoughts and go with Mr. Cooper first and let him respond, and then we'll go to you, Ms. Evans. Mr. Cooper. Thank you very much for the opportunity to join you today. And I would welcome the opportunity to come back and continue the dialog. I think that's very, very important. The key message that I want to deliver is that, in a very short period of time, we have developed our first release of an enterprise architecture for the Department of Homeland Security, and we are using it. So in spite of some of the challenges and things I shared with you, we are really doing real things on the ground. We are making progress in the information sharing arena. We have connected between States and local governments and that type of thing that previously we had no connection. And we are sharing information on a daily basis. We need to expand that. We need to buildupon it. We're not where we all want to be, but there is very positive news and a lot of it is linked to what we are learning and continuing to learn, developing our enterprise architecture. I also would like to thank some of the folks that have joined me today and would like to introduce them by name to the committee, because they really are the key people who have led a significant amount of the effort that I've been just the spokesperson for here this morning. Sitting behind me, George Brundage, Charles Thomas, Amy Wheelock and two other individuals who weren't able to join us, Katherine Santana and Ron Williams, really form kind of the core team that guided a whole host of other individuals too lengthy to name across the Department and have achieved Release 1 of our enterprise architecture. Mr. Putnam. Thank you very much. And I do want to note that DHS produced the first EA in 4 months. Mr. Cooper. That's correct. Mr. Putnam. And I don't think that can be overstated. It's very impressive, and it's a testament to your hard work and folks on your team, and a lot of the other departments can derive some lessons from that accomplishment. Ms. Evans. Ms. Evans. I too would like to thank you for the opportunity to be here today. I would like to state that I will plan to continue the work of my predecessor. I believe that he started many great things here in the government to be able to move us forward to achieve things and to really achieve value for the government and the American citizen. So I really would plan to drive toward the full utilization of the President's E-Government Initiative and progressing the work of the enterprise architectures within the agency, as well as the Federal Enterprise Architecture through the work of the CIO Council, and ensuring that the CIO Council remains a forum for discussion and for agencies as we move forward; and then continue to work to institutionalize the work he started within the management processes that are available to us, and continue to work with the subcommittee as we move forward, ensuring things such as IT security, privacy, planning, implementation and evaluation of all these IT investments for the agencies. Mr. Putnam. Thank you very much. And I want to thank both of you for your hard work and for your commitment to public service. Obviously, you bring a tremendous expertise in coordinating our IT blueprint toward eliminating those stovepipes that we talked so much about, reducing redundancies where it's appropriate and making systems more secure and maybe even saving us a buck or two. It is a complicated issue that will not be solved overnight, and I speak for the entire subcommittee in saying you have our support in working through this process. I hope that you will not burn out and cash out but keep the faith and keep plugging away because it's certainly an important yet difficult task. In the event that there are some questions from the subcommittee that we were not able to get to, I would ask the record remain open for 2 weeks for those submissions. And I believe both of you have made notes on things that we have discussed that we would like further clarification on from the subcommittee. Again, we wish you the best and thank you for your support. And with that, the subcommittee will stand adjourned. [Whereupon, at 12:15 p.m., the subcommittee was adjourned.]