DorobekINSIDER: OMB memo lays out the policies to secure cloud computing using FedRAMP

The Office of Management and Budget this morning posted a new memo [PDF or below] by Federal CIO Steven VanRoekel laying out the administration’s initiative for cloud computing security.

Known as FedRAMP — Federal Risk and Authorization Management Program— it is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. This approach uses a “do once, use many times” framework that will save cost, time, and staff required to conduct redundant agency security assessments.

The memo, titled Security Authorization of Information Systems in Cloud Computing Environments, has been widely anticipated and lays out the administration’s steps toward securing cloud computing.

Earlier this year, at a speech in California, VanRoekel suggested that FedRAMP could become mandatory.

Cloud computing is at the heart of the Obama administration’s key technology initiatives and is a prominent part of the White House 25 point IT reform plan [PDF].

View this document on Scribd

OMB’s Tim Young announces his departure, but to where?

OMB's Tim Young

We are hearing that OMB’s Tim Young has announced that his last day at the Office of Management and Budget will be Friday, Nov. 21. The unanswered question: Where is he going?

Young has been at OMB for some seven years and is credited with reorganizing OMB’s e-government and information technology. In December, Young was promoted to be deputy director. At the same time, OMB shifted the deputy director post to a career position as part of an over all reorganization of OMB’s IT management. Then, earlier this year, he was replaced by Michael Howell, who became the senior career IT executive.

It has been widely known that Young was looking for a private sector post and friends report that he has been pondering several good offers. The question at this point is… which one did he choose.

Too much good stuff for a Friday radio show

I don’t like to schedule too much good stuff for a Friday radio show because… well, let’s be honest, I think that we are all kind of tired on a Friday and do we really want tooooo much heavy lifting on the way home on a Friday afternoon?

That being said, it has been a big week and… we have lots of good stuff on Federal News Radio’s Daily Debrief with Chris Dorobek and Amy Morris this afternoon.

• EPA’s Marcus Peacock: Peacock is a CJD-fav. A little known fact — Peacock was actually the first government official to host a public blog. But he is a political who has been in government for awhile. So this is going to be the first of our “exit interviews” — seeking to tap into some of the lessons learned from those who will be leaving office on Jan. 20. In particular, Peacock has led EPA into the government 2.0 rehlm. So… we’re going to talk to him about how difficult that change is… whehter it is all it is cracked up to be is it just a lot of hype… and the role of leadership. He is a very smart guy. One quick Peacock aside: When I was at Federal Computer Week, I ran the Government Leadership Summit, which is an intimate gathering of the best and the brightest to think about how they can do their jobs better. We did the first government 2.0 conference, thanks in large part to Paul McCloskey, the former FCW editor in chief who helped run the Summit. McCloskey, now editor of 1105 GovInfo’s Government Health IT magazine, has one of the keenest minds of anybody I know. It was at that Summit that I met the EPA CIO Molly O’Neill. She got a lot out of the Summit — and used what she had learned to push EPA to try out some of these Web 2.0 activities. At the next Summit, held earlier this year, Peacock attended. He didn’t come as a speaker. He came as an attendee because he wanted to learn even more. It still is just inspiring to me that the number two guy at EPA would take the time out to look at issues in a new way. It is why I am so impressed with EPA’s radon videos — they came from front line EPA members. It is a sign of transformation. So I’m excited to talk to Peacock today.
• Microsoft’s Teresa Carlson: I told you earlier about the promotion for Microsoft’s Teresa Carlson to head up Microsoft Federal. We will have her first interview since that announcement this afternoon. We’ll ask her about her goals, what Microsoft can do for government, and how a company like Microsoft sees the government market these days.
• OMB’s Karen Evans… I have been going on and on and on about the OMB CIO memo…. This afternoon, we’ll talk to Evans about the memo and why it matters.
• SBA acting administrator… talking about how agencies are doing with small business requirements.

And, of course, you get to hear my Friday Fun Day Jazz Hands.

We just may have to come back and do a Saturday show! (KIDDING!)

Federal News Radio… 1500 AM and FederalNewsRadio.com

Read a draft of the much discussed OMB CIO memo

We’ve been telling you about the memo — due out any time now — that will outline the role of the CIO. You first read about the memo on the DorobekInsider a few weeks ago… and then we got OMB’s Karen Evans to give us some details… and you can hear Evans talk about it yourself…

The official memo isn’t out yet, but… we’ve obtained a draft of that memo.

After meeting with the departments and agencies regarding their Information Technology (IT) portfolio, I want to reaffirm and clarify the organizational, functional and operational governance framework required within the Executive Branch for managing and optimizing the effective use of IT. The IT governance framework addresses management structure, responsibilities and authorities of Heads of Departments and Agencies and their Chief Information Officers (CIOs) in planning, acquiring, securing, and operating and managing IT systems and assets within the agency. Please note the IT governance framework is not inclusive of all duties and responsibilities of CIOs.

Read more… and find a link to the full draft after the break…

Hear the discussion of OMB’s CIO memo for yourself

I mentioned last night that OMB is preparing to come out with a memo detailing the role of federal agency chief information officers.

Today on Federal News Radio’s Daily Debrief with Chris Dorobek and Amy Morris, we spoke with Transportation Department CIO Dan Mintz about his views of the role of the CIO. You can hear that interview here. [.mp3]

But I have also pulled Evans comments about the memo so you can hear them for yourself. You can find them here.

Hear OMB’s Karen Evans talk about the pending OMB CIO memo

Evans offers details on the coming memo defining the CIO

OMB’s Karen Evans was speaking at the AFFIRM lunch today — and I took the opportunity to ask her about the coming OMB memo defining the CIO, which I told you about last week. (Today on Federal News Radio’s Daily Debrief with Chris Dorobek and Amy Morris, we had Jason Miller on talking about the memo. Hear that conversation here .mp3]

Of course, agency CIOs have been required for more than a decade. They were mandated by the Clinger-Cohen Act. But since then, the government IT community loves to debate the role of the CIO — and we always hear about CIOs having a ‘seat at the table.’

The Bush administration will publish a memo — as soon as next Monday, Oct. 20 — defining the role of agency CIOs. And Evens said today that information technology is managed very differently in different agencies, and the memo will seek to put a framework around the position — particularly as the government heads into the transition period.

“What we wanted to do was to re-emphasize clearly that it is important that information technology be managed through the transition and be managed on an ongoing basis,” she said.

Evans was very frank about the memo — not that she isn’t usually frank, but…

The memo will focus on the procurement and human capital provisions of the CIO post, Evans said. OMB used as its basis the memo issued by the Homeland Security Department Secreatary Michael Chertoff. The big difference, of course, is that the DHS memo gave the CIO the power of the purse — budget control over IT spending initiatives. I’m told that this memo will not include budget authority.

Here is FCW’s March 2007 story about the DHS CIO announcement. I also made it FCW’s Buzz of the Week for the week of March 19, 2007… and the following week, in FCW’s editorial, under the headline Show ’em the money, I gave DHS credit for giving the DHS CIO spending authority over IT spending.

A few interesting points. One is that DHS, of course, has not made that memo public. DHS Secretary Michael Chertoff first announced these new provisions at a meeting of the Northern Virginia Technology Council in March 2007. (My original post back when I was the FCW Insider.) DHS doesn’t even have that speech posted.

Furthermore, again when I was at FCW, when FCW’s Ben Bain and I sat down for a conversation with DHS CIO Richard Mangonia, he specifically said that the DHS reporting structure didn’t matter.

FCW: How important is it who you report to within the organization?
Mangogna: I get my authority based on my understanding of what needs to get done and the values I get from the secretary, deputy secretary and the undersecretary for management. I don’t need any more direction than that, and I don’t think you have to manage this job by mandatory documents going down to all the CIOs and telling them to do this and that.

The reporting structure isn’t important in terms of leadership — I always say that leadership isn’t about any position. It is about getting people to believe what you believe. The reporting structure, like an agency’s budget, does say something about what an organization values. So it is perhaps interesting that OMB is using DHS as the model for this memo. DHS, after all, is one of the agencies that does not follow the Clinger-Cohen Act requirement that the CIO report to the head of the agency.

Finally, it is important to note that there are only two agencies that how the ‘power of the (IT) purse’ — DHS, by policy, and the Department of Veterans Affairs, by law.

Back to Evans for a moment… She noted that the memo is focusing on information technology, not on information management. That is largely because the information management issue ends up involving so many different parts of different organizations that it would just never get done — particularly with the amount of time left in the Bush administration.

This memo seems to be developing out the the upcoming transition, but… it seems like something that could have been done a long time ago.

Some related reading on this topic:

* FCW was at the AFFIRM event today and has a story.
* In the September issue of AFFIRM’s Signal magazine, Lt. Gen. Harry D. Raduege Jr., USAF (Ret.), the former head of the Defense Information Systems Agency, has a piece headlined, Government Oversight and the CIO . The piece has sturred some buzz around the government IT community. The money quote:

It is time for a major step toward achieving CCA strategic business benefits. This step should be to assign CIOs holistic responsibility for the areas noted above instead of allowing competitive activity outside the CIOs’responsibility and domain. After 12 years, it is time to recruit and train better CIOs, eliminate the gap between the CCA and actual practices, and give CIOs the authority needed to succeed.

* Finally, Democratic presidential candidate Sen. Barack Obama (D-IL), as part of his technology platform, has proposed creating a government CTO. Here is what it says on his Web site:

Bring Government into the 21st Century: Barack Obama and Joe Biden will use technology to reform government and improve the exchange of information between the federal government and citizens while ensuring the security of our networks. Obama and Biden believe in the American people and in their intelligence, expertise, and ability and willingness to give and to give back to make government work better. Obama will appoint the nation’s first Chief Technology Officer (CTO) to ensure that our government and all its agencies have the right infrastructure, policies and services for the 21st century. The CTO will ensure the safety of our networks and will lead an interagency effort, working with chief technology and chief information officers of each of the federal agencies, to ensure that they use best-in-class technologies and share best practices.

Of course, it is unclear how this CTO will work within OMB… with CIOs… Sooooo many questions… About 20 days and we’ll at least begin to know who we go to for answers.

I’m fascinated by this and I’m going to keep on it because it seems important to me — and could be a real opportunity for CIOs and the CIO Council. I’m going to be following it closely. Tomorrow on Federal News Radio’s Daily Debrief with Chris Dorobek and Amy Morris, we’re going to talk to Roger Baker, the former Commerce Department CIO. (Baker was on Federal News Radio’s InDepth program last month talking about the concept of a CTO. It is worth a listen.)

OMB to memo on the role of the CIO (Hint: There should be one)

Yes, there are only 21 days until election day… 98 days until inauguration day… but Clay Johnson, OMB’s deputy director for management, is going to put out a memo — possibly as early as this week — on the role of the CIO.

More than a decade after the Clinger-Cohen Act was passed that mandated agencies have a chief information officer, the role of theCIO is still being fully fleshed out. In some agencies, it is the person who makes sure that the e-mail gets through and that the BlackBerries work. In the best agencies, the CIO has — dare I say it — the CIO has the infamous “seat at the table.” (Even the phrase “a seat at the table” has grown to have almost nirvana-like qualities — ‘if I only had a seat at the table.’)

In my humble opinion — and I would love to be corrected — few CIOs are truly active members of agency senior leadership teams. And often times CIOs can get so tied up in making sure all the IT works and that systems are on track, that they just don’t have time to be the strategic player.

Some of the best organizations — public or private sector — are ones that use IT to accomplish their missions.

I’m hearing that the memo will remind agencies about what the role of the CIO should be.

It’s interesting because there are some who think that OMB has undercut the role of the CIO in recent years. More on that later.

DorobekInsider.com: Interior’s Howell to move to OMB

Interior Department CIO Mike Howell will become the government

In what may have been the worst kept secret in government IT, Interior Department CIO Mike Howell has a new job — and a powerful new job at that. Howell has accepted an offer to be OMB’s deputy administrator for e-government and information technology, the federal government’s senior career IT position. Howell will move to OMB in mid-September, government and industry officials confirm, replacing Tim Young.

In December, Young was promoted to be deputy director. At the same time, OMB shifted the deputy director post to a career position as part of an over all reorganization of OMB’s IT management.

Young, however, is a political appointee who therefore must leave at the end of the Bush administration. Insiders say that he is in the process of searching for an IT management consulting position.

Howell will serve as the deputy to Karen Evans, OMB’s administrator of e-government and IT. Howell has served as Interior CIO since May 2007 and has worked in many parts of the Interior organization. It is unclear who will take Howell’s place as Interior CIO.

The position becomes exceedingly important with the looming administration transition and was widely seen as a plum post — not officially “plum,” but… you know what I mean. OMB received more than 75 applications for the post.

Evans has told friends that she wouldn’t be opposed to staying on as a bridge to a new administration, but it is most likely that Howell, as deputy, would become the government’s most senior IT official until a new e-gov/IT administrator is named.

The move will also set off a scramble for who would be the new Interior CIO. Jerry Williams joined DOI as the deputy CIO in July replacing Ed Meagher, who left to join SRA International. Williams would be the obvious choice, but Interior often works in mysterious ways.

You can read Howell’s Interior bio after the break.

DorobekInsider.com: Where did Robert Burton go?

Last month over on the other blog, there was video evidence that Robert Burton retired as the deputy administrator of the Office of Federal Procurement Policy.

After taking some time off this summer, Burton has a new gig as an attorney at DC’s Venable law firm.

Stay tuned. We hear an “official” press release is in the works… and you may even hear him around town sometime soon.