Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
For four 46 of 10 appropriated IT security investments reviewed, the Department did not
provide documentation showing obligations and expenditures. Approximately $164 million was
appropriated for the IT security investments; however, because of the lack of documentation for
the project expenditures, there is an increased risk associated with the potential inability to
achieve overall security program objectives within defined cost, schedule, and technical
constraints. The CIO did not comply with provisions of the Clinger-Cohen Act of 1996, which
require assumption of responsibility and accountability for IT investments. Inadequate
monitoring shows a lack of accountability once funds are approved.
We identified the following control weaknesses related to the CPIC process:
� The Department did not provide OMB with required information related to
IT security investments that have a significant dependency for the IT
Infrastructure major investment. In a sample of 10 non-major investments
that made up the IT Infrastructure major investment, we found none of the
10 investments were identified by the unique project identifier (UPI) in
OMB Circular A-11 47 Exhibit 300, 48 even though OMB requires an agency
to report IT security initiatives and investments not directly tied to a major
investment on a separate line identified as “non-major.” By not including
IT security investments that have a significant dependency on the IT
infrastructure major investment in the exhibit 300, OMB does not have an
accurate amount spent on IT security.
� IT security costs from the Department’s Plans of Actions and Milestones
(POA&Ms) are not captured in the capital planning process. Specifically,
the Department’s implementation of the POA&M process did not reflect the
unique project identifiers (UPI) 49 for each corrective action plan as required
by OMB. 50 According to OMB, security costs identified in POA&Ms are
required to be captured within each investment’s Exhibit 300 and
summarized to Exhibit 53. 51
IRM had not developed procedures to reflect guidelines contained in the FY 2010
OMB Circular A-11, which states that non-major investments that are directly tied to
major investments can be collapsed into a major investment. The Department was not
aware of the OMB 52 requirement that each POA&M must have a unique project
46
The four systems are Department Bandwidth Management, Foreign Affairs Network, IT Infrastructure–IRM, and
Enterprise Network Management.
47
OMB Circular A-11, Preparation, Submission, and Execution of the Budget.
48
Exhibit 300, Capital Asset Plan and Business Case Summary, is the document OMB uses to assess investments
and ultimately make funding decisions. The exhibit also provides OMB with a robust assessment of the investment
and is the vehicle for IT investments to justify lifecycle and annual funding requests to OMB.
49
UPIs consist of the identifier depicting agency code, bureau code, mission area (where appropriate), part of the
exhibit where investment will be reported (Exhibit 300), type of investment, agency four-digit identifier, and twodigit
investment category code.
50
OMB Memorandum M-02-01, Guidance for Preparing and Submitting Security Plans of Action and Milestones.
51
Exhibit 53, Agency IT Investment Portfolio, provides an overview of the agency’s entire IT portfolio by listing
every IT investment, lifecycle, and budget-year cost information.
52
OMB Memorandum M-02-01, Guidance for Preparing and Submitting Security Plans of Action and Milestones.
32
UNCLASSIFIED