A Look Ahead

1
A Look Ahead

• Presented byMary Heard, OCIO

2
Where We Were

• Ad-hoc Incident Response Process with no
  Tracking system
• Certification and Accreditation documents that
  did not meet NIST requirements
• Fragmented policies
• Stove-pipe, disparate approaches to security

3
Improvements

• A repeatable incident response process and a
  method to track incidents and resolution
• A concurrency process that helps ensure
  Certification and Accreditation documents meet
  NIST requirements
• Several new Department-wide approaches to
  security implementation and administration
• Awareness of security and privacy protection at
  a whole new level

4
A Look Ahead

• Focus on managing risk closing POAMs
• Brief Sub-Cabinet periodically with stoplight
  scoring
• Align policies with Federal requirements and
  provide more flexibility to the agencies with a
  focus on data
• Establish a Security Operations Center and
  enterprise-wide security tools to assist in
  compliance and monitoring
• Reduce duplication of effort and leverage A-123
  testing to address FISMA control testing

5
Questions?