The Department of Veterans Affairs has a security problem.
The agency is struggling under an onslaught of cyberattacks, a growing backlog of vulnerabilities to patch, and a lack of staff and money to handle the workload. The VA failed its last 16 FISMA audits.
Then the VA released NEWT.
Development began on the Nessus Enterprise Web Tool in January 2014 and, after initial successful pilots, it was rolled out across the agency earlier this year. The tool pulls together all known vulnerabilities and security workflows into a single database that prioritizes the threats and helps assign staff to optimize efficiency.
Using this data-driven management tool allowed VA security personnel to patch 55 percent of known vulnerabilities, including all of the critical- and high-level weaknesses.
“All the different scans that we do, it pulls them into a single screen, color-codes it and prioritizes it for them in terms of what’s a critical, what’s a high, what’s a medium and what’s a low,” VA CIO Stephen Warren explained. “We moved from this manual process … and now it’s a tool that actually sorts it and segregates it, pulls out the false positives and gives it to them in such a way that it’s actionable.”
The White House has made harnessing the power of federal data a top priority over the last few years, firing off a series of memos and executive orders to press agencies to use their data to make better management, spending and program decisions.
Data is more than IT
On May 8, Beth Cobert, the deputy director for management at the Office of Management and Budget, said the administration was seeking to improve the effectiveness of government by making better use of federal data.
“By making federal spending data more accessible, searchable and reliable, and joining this information with other third-party data sources, federal agencies and taxpayers have an opportunity to better understand the impact of federal funds and improve the lives of the American public,” Cobert said.
Data can be used to improve more than just IT and cybersecurity, helping federal managers better allocate grant money, evaluate agency programs and design more effective citizen services. Better use of data touches all aspects of the federal government, and the administration is working hard to make sure agencies follow through on the promise of data.
“Our goal is to ensure that the government wisely uses each taxpayer dollar to the maximum effect,” Cobert said.
Tom Allin, the VA’s first veteran experience officer, said the agency is linking together about 2,000 databases in order to give veterans and VA employees the ability to have all the information they need to make appointments, check benefits and resolve issues.
The data will be used to drive large changes in how the agency operates, including a unified web portal, consolidated customer service phone numbers and new programs that will provide veterans with quick information and updates — without duplicative paperwork, Allin said.
“We have a lot of databases that are legacy systems that we will keep. But it is a question of how do you organize the data so that it’s kept clean and kept current so if a veteran changes their address in one of the databases, it automatically gets changed in all the others,” Allin said.
But the VA is also creating an entirely new way to measure customer service and experiences by crafting a common satisfaction metric across all of its hospitals, agencies and centers, according to Allin.
“We are going to have a veterans’ experience measurement that will be used across all of the administrations and across all interfaces, whether it is face to face in one of the VA medical centers, whether it is online or whether it is through the web page,” Allin said.
The measurement index will help the VA craft better services and give veterans better experiences when they interact with the VA. Standardizing the data used will also help the VA compare different operating units and benchmark itself against the private sector, according to Allin.
“The issue today in many of the customer measurements that we are using is that they are done by surveys and so the data is six months old. We want to have data that is more current and more actionable that we can immediately leverage,” Allin said.
Speaking one language
How agencies manage their budgets is a prime example, as financial reporting is often convoluted and inaccurate. The administration is pushing agencies to standardize how spending data is managed, in order to create a more transparent and efficient government.
David Mader, the controller of the Office of Federal Financial Management at the Office of Management and Budget, and David Lebryk, the fiscal assistant secretary at the Treasury Department, said in a blog post one year after the passage of the Digital Accountability and Transparency Act (DATA Act) that the administration is starting to roll out 57 data standards to help streamline the use of data the government already collects.
“Currently, the federal government produces huge amounts of data about how it spends money, but in some cases the same words are used in different ways. These inconsistencies make it difficult to use this data in a comprehensive way,” they wrote.
The new data will be used at Data.gov and USAspending.gov. The administration has also identified 30 data standards already in use across the government. Over time, agencies will be able to use more and more data collected by other departments.
An ‘imperfect process’
In order to make better decisions, federal managers need to know the data they have is reliable and means the same thing no matter who is looking at it.
Agencies need a “common way to think about IT from the perspective of what we spend on IT and being able to relate that back to achieving broader purposes for our organizations,” said Interior CIO Sylvia Burns, who is also a member of the IT Cost, Opportunity, Strategy and Transparency Commission, a public-private partnership created to help develop standards around reporting IT spending. “It may seem mundane to some but it’s actually really important to federal CIOs like me because we’re on this constant quest to get a handle on what we really spend on IT.”
Federal agencies collect a wealth of data daily, though that information is often labeled and processed using outdated or inconsistent rules, making the data suspect or completely unusable.
“It’s a very imperfect process — a lot of the numbers are self-reported. In terms of having fidelity around what is the true value of the portfolio and where does the organization want to make trade-offs or make certain decisions, it’s very hard to use the portfolio for business decisions,” Burns said. “How do you tie what you’re spending on IT to the financial systems, which is a true system of record?”
Having numbers based directly off the financial accounting system will help ensure their accuracy, or at least make it easier to identify problems, Burns said.
Ideally, the DATA Act will make that data more tangible by requiring all federal agencies to report spending using a standardized taxonomy. When fully implemented, the act should bring more transparency to how the government spends its budget, including within the agencies themselves.
“Once you have good data and the groupings are right, it allows decision-makers to identify the opportunities where you’re not leveraging economies of scale where you could be,” Burns said.
This is particularly challenging at the lowest levels, where bureaus might be making smaller IT purchases that aren’t always reported properly, or at least in a way that can be managed at the department level.
Burns cited a specific example at the Department of the Interior where component bureaus were buying a particular software license as needed, unaware that the department offered a contract vehicle that provided the same software at a better price.
“That’s the real value that we’re ultimately getting to: the efficiency in the IT spending, which is very hard to get right now,” she said. “There is very poor visibility at the top level of the cumulative spending throughout the whole organization. It’s challenging to see where you have inefficient spending.”
Once agencies have reliable data, CIOs will have more insight into how budgets are being spent and make more efficient use of their IT dollars.
“It’ll probably start at the high-level decisions about how we’re purchasing certain things,” Burns said. “One of the areas it can have the fastest influence is around how we’re doing strategic sourcing. … It could change how people buy stuff, from an operational perspective.”
More data, less hassle
The General Services Administration is using data to better develop the programs and policies of the future, based off a better understanding of its federal customers, according to the agency.
The development of category management — which would give GSA and customer agencies pricing data, contract spending information and new digital tools to help navigate the complex world of federal contracts — is a top priority for the agency, according to Tiffany Hixson director for GSA’s Northwest/Arctic Region.
“Our contracting officers are going to have much better pricing insight than they do today, which is really going to make the schedules much more cost effective and productive in the long run for our agency customers,” Hixson said.
But the linchpin in the category management effort is to create price transparency among federal contracts.
GSA has proposed requiring contractors to report prices they offer agencies for products and services. GSA has already saved agencies more than $300 million since 2010 by using enhanced pricing data, according to the agency.
The proposed rule would allow agencies to compare prices on products and services and would be implemented in all of GSA’s governmentwide contract vehicles, except for its Multiple Award Schedules contract vehicles, where the agency would phase in the new rules.
By the end of fiscal 2016, the government will have critical contract data for the $275 billion of spending in the 10 most basic categories, and it will have tens of thousands of acquisition workers able to access that data to make better decisions.
GSA is also gathering data in the form of labor prices across contracts, which will help agencies research the costs of various forms of labor when developing their own contracts. But overall a stronger focus on data will help GSA deliver better services and create better contracts.
Hixson said the agency will keep gathering and collecting data and using that data to help the government make better decisions.
“Before we did not have a strategic approach to dealing with our federal agency customers, how GSA is supporting them in buying those services and how we could be adding better value for that. That analytical work was not happening. It is today,” Hixson said.
