Printer Friendly Page
VA PUTS NEW INFORMATION TECHNOLOGY INTERNAL
AFFAIRS UNIT ON FAST GROWTH TRACK -- Last
year's
laptop theft has led to the creation of a
fast-growing unit
that is charged with keeping an eye on IT at
the VA.
For more about VA data security and data theft,
go to this page...
http://www.vawatchdog.org/va%
20data%20theft%20news.htm
Story here...
http://www.computerworld.com
/action/article.do?command=viewArticle
Basic&taxonomyId=13&articleId=
9039238&intsrc=hm_topic
Story below:
-------------------------
VA puts new IT internal affairs unit on fast
growth track
Patrick Thibodeau
(Computerworld) WASHINGTON -- The laptop theft that roiled the U.S.
Department of Veteran Affairs last year prompted a data security
overhaul and an ongoing centralization of the agency's IT operations.
And it led to the creation of a fast-growing unit that is charged with
keeping an eye on IT at the VA.
The Office of IT Oversight and Compliance, known as ITOC, was formed
early this year with just seven employees. It now has a staff of 128
workers and is expected to grow to 165 employees by 2009.
In a memo last February (download PDF
http://www.research.va.gov/
resources/policies/docs/OIT-
Compliance-Memo-021207.pdf
), VA Secretary R. James Nicholson gave the ITOC a broad mandate to
inspect the agency's IT operations and determine whether they are in
compliance with laws and regulations. The ITOC will also act as a first
responder within the agency to IT security incidents that require review
of privacy and security processes.
Arnaldo Claudio, the ITOC's executive director, offered some insight
into his organization on Wednesday in testimony before the House
Committee on Veterans' Affairs. Claudio was one of more than a
half-dozen witnesses who testified at the hearing, which was held to
review the progress of the VA's IT reorganization.
Claudio said the ITOC's goal is to provide "independent, objective and
quality oversight and compliance assessment services." The unit's rapid
growth in head count "is in itself a success story," he said. "Most
government programs take years before they can be stood up and become
fully operational."
The ITOC has hired workers from within the private sector as well as the
government, according to Claudio. It reports to top IT officials at the
VA, including CIO Robert Howard, who also testified at the House
hearing.
Prior to the creation of the ITOC, a group called the Review Inspection
Division (RID) was tasked with doing reviews and inspections of IT
services within the agency. But it was staffed by only five VA employees
plus "a handful of contractors," Claudio said. With a total of 12,000 VA
sites to inspect, the RID "was given an impossible task to perform," he
added.
Claudio told the committee that the idea for the ITOC was suggested, in
part, by Eugene Spafford, a professor at Purdue University and executive
director of the school's Center for Education and Research in
Information Assurance and Security.
Spafford testified before the House Committee on Veterans' Affairs in
June 2006 -- one month after the laptop and a hard drive containing the
personal data of 26.5 million veterans and active-duty military
personnel were stolen from a VA employee's home in Maryland. In his
testimony (download PDF
http://usacm.acm.org/usa
cm/PDF/VA.pdf ), Spafford pointed out
that the VA lacked a centralized point of authority "to ensure that
rules, procedures and good practices are instituted and observed."
The U.S. Government Accountability Office said last week that the VA has
made some progress on improving its IT security processes since the
theft of the laptop and hard drive, which were recovered about a month
and a half after they were taken.
But in a report (download PDF
http://www.gao.
gov/new.items/d071246t.pdf ) that was released
publicly last week in connection with an IT oversight hearing held by
the Senate Committee on Veterans' Affairs, the GAO added that the VA has
yet to fully implement two of the federal watchdog's four security
recommendations and 20 of 22 suggestions from the agency's own inspector
general.
The GAO issued another report on Wednesday to coincide with the House
hearing. In this week's report (download PDF
http://www.gao.gov/new.i
tems/d071264t.pdf ), the GAO said the VA
hasn't kept to scheduled timelines for implementing new management
processes that are the foundation of its IT realignment. The GAO added
that if the VA doesn't dedicate a team of employees to oversee the
implementation of the realignment plan, the agency could miss its July
2008 target date for completing the internal changes.
Howard told the House panel that the VA has already adopted some of the
GAO's recommended actions, such as implementing an IT governance plan
and accelerating the development of performance metrics for tracking the
progress of the realignment work. The GAO, he acknowledged, had
"correctly identified that there is more work to be done to have a
successful transition from a decentralized to a centralized
organization."
-------------------------
Larry Scott --
