24.10.2014 Views

United States DEPARTMENT of Commerce

United States DEPARTMENT of Commerce

United States DEPARTMENT of Commerce

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

M Aa Nn Aa Gg Ee Mm Ee Nn T t I Nn tT eE gG rR aA tT iI oO n N G Oo Aa L l * P e r f o r m a n c e S e c t i o n<br />

Continued implementation <strong>of</strong> the OMB mandated Information System Security Line <strong>of</strong> Business (ISSLoB) Federal Information<br />

Security Management Act (FISMA) tool to automate certification and accreditation (C&A) standards and security reporting.<br />

Implemented Department-wide e-mail system consolidation.<br />

OMB considers all Department business cases for major information technology (IT) investments acceptable. This ensures that<br />

IT funds are managed and invested wisely.<br />

The Department’s major IT investments were, on average, within five percent <strong>of</strong> cost, schedule, and performance targets.<br />

Developed an FY 2007 security awareness training plan, including milestones, for authorizing <strong>of</strong>ficials and system owners.<br />

Developed IT C&A compliance and oversight controls based on OMB requirements, National Institute <strong>of</strong> Standards and<br />

Technology (NIST) standards, and past OIG recommendations.<br />

Installed a Herbert C. Hoover Building network intrusion prevention system for monitoring and reporting IT security<br />

violations.<br />

The Department uses reviews and reports generated by the OIG, OMB, the Government Accountability Office (GAO), other<br />

Congressional organizations, government-wide task forces, and other objective sources to evaluate activities <strong>of</strong> the Department<br />

related to this goal. For example, DM works closely with OMB on implementing the five government-wide management initiatives<br />

established in the President’s Management Agenda (PMA). The Department is rated quarterly on its success in implementing these<br />

initiatives. In addition, many <strong>of</strong> the laws pertaining to these activities have separate reporting requirements, which highlight both<br />

strengths and weaknesses <strong>of</strong> the Department’s administrative functions. The Department uses the results <strong>of</strong> these efforts to assess<br />

achievement <strong>of</strong> performance targets.<br />

The performance-based contracting measure was not met in FY 2007. Limitations within the procurement infrastructure, e.g.,<br />

data accuracy and level <strong>of</strong> staff expertise, continue to frustrate efforts to meet this goal. These issues are being aggressively<br />

addressed within the procurement community.<br />

Data on awards to small businesses are not considered to be final until the Small Business Administration issues the Small<br />

Business Goaling Report later this year. Preliminary figures, as <strong>of</strong> November 15th, indicate that the Department achieved 44<br />

percent, pending validation and verification <strong>of</strong> data in the Federal Procurement Data System (FPDS). The preliminary number<br />

suggests that the Department did not achieve the 48 percent target, which was based on the most recent three years <strong>of</strong> activity<br />

that are not necessarily sustainable. It is important to note that significant changes have occurred or are underway which will<br />

impact the percentage <strong>of</strong> the Department’s opportunities available for future small business participation. These include the<br />

transition <strong>of</strong> the <strong>Commerce</strong> Information Technology Solutions Government-Wide Acquisition Contract (COMMITS GWAC, a small<br />

business set-aside) to the General Services Administration, and large contract awards to support the GOES-R Satellite Program,<br />

the 2010 Decennial Census, and NOAA’s phased ship replacement. In light <strong>of</strong> these anticipated changes, the Department plans to<br />

negotiate its FY 2008 and out-year small business goals with the Small Business Administration to reflect more realistic goals.<br />

The financial management measure <strong>of</strong> eliminating any significant deficiency (previously referred to as a “reportable condition”)<br />

within one year also was not met. The significant deficiency concerns consolidated IT controls. Although the Department has<br />

made progress toward eliminating this problem, more requirements were added to the OIG auditors’ review <strong>of</strong> IT controls in<br />

support <strong>of</strong> the FY 2007 Consolidated Financial Statement Audit when, for the first time, the auditors used NIST Special Publication<br />

800-53, Recommended Security Controls for Federal Information Systems, in conducting the review. The OIG auditors used a risk-<br />

F Y 2 0 0 7 P E R F O R M A N C E A N D A C C O U N T A B I L I T Y R E P O R T<br />

169

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!