After the breaches were identified, OPM took a harder look at a number of its applications and ended up pulling the e-QIP background investigation online submission form in order to make substantial security upgrades. (Note: the e-QIP app was not directly affected by the breaches.)

More: OPM e-QIP system back online … for some

With the system offline, the Department of Homeland Security and General Services Administration – the agencies managing the CDM program – were unable to onboard key people needed to move ahead with implementation on the two task order two awards already issued.

“The shutdown of e-QIP delayed the onboarding of the technical resources that were going to protect agency networks from future problems like the OPM hack,” said Chris Hamm, director of GSA FEDSIM, noting the irony.

More: $39M CDM contract awarded for six major agencies

The program is moving along again now, and awards for Groups C, D and E are expected in early September.

Hamm said he has been just as frustrated by the delays as agencies and industry.

“It’s frustrating to me, personally, that it’s taking this long,” he said. “But it’s part of the necessary process in order to deliver this.”

Related: GSA changes strategy for last pool on major cyber program

In an email circulated to agencies Tuesday, acting OPM Director Beth Cobert said the cost of providing monitoring and protection to almost 10 times the number of current federal employees would be too much for a single agency to bear.

More: 22 milllion Americans affected in second OPM breach

Since the background information in the hacked databases were kept on behalf of other agencies, OPM and the Office of Management and Budget determined that the cost of providing protection services should be spread across the affected agencies.

“Given the limited resources available to OPM at this time to deal with a contract of this size, agencies will be asked to contribute FY 2015 funding to cover the first full year’s cost of credit monitoring and related services/benefits for the second incident,” Cobert said in the email.

Under the OMB-approved plan, OPM is assessing the cost per person and plans to let each agency know their share of the total cost sometime next week.

The email notes the actual cost per agency won’t be known until a contract is awarded.

More: Feds worried insurance doesn’t cover OPM breach

Each agency with affected employees (i.e., every agency) will have to find funding in its 2015 budget, as well as planning for future payments through 2017, as OPM intends to purchase a plan that includes at least three years of credit monitoring.

“OPM is committed to providing those affected by the recent cyber incident involving federal background investigations data with information and appropriate resources in a timely and effective manner,” said OPM Press Secretary Sam Schumach. “OPM is asking each agency to fund a share of the cost of monitoring and protection services approximately proportional to the number of individuals impacted.”

OPM Data Breach: What You Need to Know

On the same day that Homeland Security Secretary Jeh Johnson said the OPM breach was a wake-up call and called on the House Judiciary Committee to specifically fund the EINSTEIN cybersecurity system for federal agencies, at least two members of Congress said they plan to investigate the OPM breach and government cybersecurity writ large.

Related: Johnson calls for broad effort to improve cybersecurity

The results of those investigations could mean serious consequences for leaders failing to uphold IT security at their agencies.

“The recent OPM hack and the departure of Director [Katherine] Archuleta is, I think, a good thing – because guess what? Every agency head and CIO should be pulling out their [inspector General] report on their digital infrastructure, because we’re going to start calling them before our committee and asking them the same questions,” said Rep. Will Hurd (R-Texas), chairman of the House Committee on Oversight and Government Reform’s IT subcommittee. “We’re going to make sure we don’t see what happened at OPM happen again at other agencies. Now, the example is set: Major breaches are bad things and you’re going to lose your job. That’s great motivation within the federal government.”

Full Coverage: The OPM Data Breach: What You Need to Know

Hurd spoke July 14 in Washington at an event held by Digital Globe and Cloudera.

Given that part of the OPM breach involved a database with security clearance-related data, many of the records stolen in the breach belonged to Defense Department employees and members of the military. That’s particularly troubling to Rep. Mac Thornberry, who on July 14 pledged the House Armed Services Committee, which he chairs, will in the coming weeks hold hearings and briefings related to the breach.

“We have an obligation to ensure that those who serve the department, in or out of uniform, are able to do so securely,” he said in a statement, according to Military Times. Thornberry also said he plans to investigate “larger questions of cyber defense and the security clearance process.”

At least some of those questions will center on the government’s procurement, use and management of IT systems – or their lack thereof.

“Agencies are buying software that have security functions, and they’re disabling them. That’s outrageous. In the design of digital infrastructure, they’re not using secure practices,” Hurd said. “The IRS is talking about moving from a relatively [21^st]-century system back to mainframes. They literally are trying to move data back to mainframes. That’s insane. So a lot of this is tied up in how the federal government is purchasing IT goods and services…we’re trying to shine a light on that.”

Hurd said that his subcommittee plans to roll out a system that will measure federal agencies’ adherence to IT security rules and standards.

“We’re coming up a scorecard that we’ll be using against agencies on whether they’re following basic practices in digital hygiene and cybersecurity,” he said.

Less than 24 hours after

“Today I informed the OPM workforce that I am stepping down as the leader of this remarkable agency and the remarkable people who work for it,” Archuleta said in an email to staff Friday, stating she submitted her resignation to President Barack Obama that morning, which he accepted.

More: Archuleta says she won’t resign in wake of OPM breach

Archuleta did not directly mention the massive breaches of OPM’s network that led to the exposure of personal information on more than 22 million Americans, most of them current, former or prospective federal employees. However, she alluded to the crisis in her farewell.

“I conveyed to the president that I believe it is best for me to step aside and allow new leadership to step in, enabling the agency to move beyond the current challenges and allowing the employees at OPM to continue their important work,” she wrote.

Thursday, while stating that she did not intend to resign, Archuleta also expressed her support for the rest of the staff, including agency CIO Donna Seymour. She reiterated her support for the staff in her email Friday.

More: OPM breach affected 22 million Americans

“I am honored to have led this organization and to have served alongside the incredible team at OPM,” Archuleta wrote. “I have complete confidence in their ability to continue to fulfill OPM’s important mission of recruiting, retaining and honoring a world-class workforce to serve the American people.”

Office of Management and Budget Deputy Director Beth Cobert will be stepping in as acting director until an official replacement is named.

OPM Data Breach: What You Need to Know

The resignation comes after legislators turned up the pressure on Archuleta to step down, including members of her own party.

“This is the right move for the agency and all those affected by the breach,” Sen. Mark Warner, D-Va., said after hearing the news. “The focus now needs to be on fixing the problem and protecting those impacted.”

Four Democratic senators have come together to put forward legislation that would provide lifetime credit monitoring and at least $5 million in identity theft insurance, compared to the $1 million currently being offered.

More: Feds worried insurance doesn’t cover OPM breach

The Reducing the Effects of the Cyberattack on OPM Victims Emergency Response (RECOVER) Act was introduced on Thursday by Sens. Ben Cardin, D-Md., Barbara Mikulski, D-Md., Mark Warner, D-Va., and Tim Kaine, D-Va.

The senators said they were outraged by the OPM breach, as well as the agency’s response, which they deem inadequate.

“Private-sector cyber hacks and cyberattacks have become too commonplace, but when the federal government’s own computer system shows its vulnerabilities to the world, we have a responsibility to protect the people who have been put at risk,” Cardin said. “We need to plug the holes in the federal network and make sure our workers, their families and all those who have been violated are held harmless from any damage that may be done.”

OPM Data Breach: What You Need to Know

The staggering scope of the second breach – which affected almost 20 million current, former and potential federal employees and another 2 million family members and friends – along with the kinds of personal information stolen moved the lawmakers to ensure everyone affected is fully protected.

“[Thursday’s] news that 21.5 million additional Americans were affected by one of the OPM breaches is a stark reminder of how far-reaching the impact is here,” Kaine said. “The least we can do for the millions of past, current and prospective federal employees whose personal information has been exposed is provide them with the strongest protections available.”

More: OPM breach affected 22 million Americans

Along with added protections under the RECOVER Act, Warner also called for the resignation of OPM Director Katherine Archuleta Thursday, criticizing her response to the breach.

“The technological and security failures at the Office of Personnel Management predate this director’s term but Director Archuleta’s slow and uneven response has not inspired confidence that she is the right person to manage OPM through this crisis,” he said.

During a call with reporters Thursday, Archuleta said she has no intention of stepping down from her position and also reaffirmed her support for OPM CIO Donna Seymour.

More: Archuleta says she won’t resign in wake of OPM breach

Lawmakers began calling for Archuleta’s departure after the first Congressional hearing June 16, with more joining the chorus in the days to follow.

More: Lawmakers demand OPM chief’s resignation

With the announcement Thursday that some 21.5 million records on current, former and prospective federal employees, as well as relatives were exposed in the second breach, the question of Archuleta’s tenure at OPM was raised again.

“When I took office in late 2013, one of my priorities was to upgrade OPM’s antiquated legacy systems,” she said during a call with reporters Thursday. “It is because of the efforts of OPM and its staff that we’ve been able to identify the breaches.”

More: OPM breaches affected 22 million Americans

After being pushed by reporters to clarify, Archuleta confirmed that she will not be stepping down and affirmed her support of agency CIO Donna Seymour, as well.

“No … I am committed to the work that I am doing at OPM,” she said, adding, “I have trust in the staff that is there, including Donna Seymour.”

Archuleta expressed her sympathy to those affected by the breaches and asserted OPM’s commitment to protecting employee data.

“To those that have been directly affected by this theft of information, I truly understand the impact this has on our current and former federal employees, our military personnel and our contractors,” she said. “Each and every one of us at OPM is committed to protecting the safety and security of the information that is placed in our trust. And we remain committed to do everything in our power to assist those that have been impacted by this incident.”

OPM Data Breach: What You Need to Know

Some 3.6 million of those affected in the second breach were also compromised in the first breach, which affected 4.2 million federal employees. The combined tally brings the total number up to 22.1 million.

That number represents about 6.9 percent of the nation’s population, which was pegged at 319 million in 2014.

OPM Data Breach: What You Need to Know

“If an individual underwent a background investigation through OPM in 2000 or afterwards, it is highly likely that the individual is impacted by this cyber breach,” an OPM official said Thursday. “If an individual underwent a background investigation prior to 2000, that individual still may be impacted but it is less likely.”

In June, OPM confirmed that hackers had broken into a database housing background investigations on all current, former and prospective federal employees seeking security clearances over the last 20 years. That database included highly sensitive Standard Form 86 documents, which also include information on family members and close friends, extending the tally beyond just federal employees.

Candidates for security clearances make up 19.7 million of those affected in the second breach. An additional 1.8 million family members and other associates were also compromised, OPM Director Katherine Archuleta said Thursday.

Officials noted a separate system containing information on health, finances, payroll and retirement records was not compromised in either breach. However, the stolen data does include interviews conducted with family members and roommates, as well as some 1.1 million fingerprints.

“It is an enormous breach,” FBI Director James Comey said while testifying in front of the Senate Intelligence Committee on July 8. “A huge amount of data that is personal and sensitive to federal employees, former federal employees, people who have applied for federal employment was available to the adversary and we have to assume that it was looked at and/or exfiled. We’re talking about millions and millions of people affected by this.”

Comey noted the hackers likely got his information, as well, which includes information on his family and friends.

OPM is offering at least three years of credit monitoring to individuals affected in the second breach, along with identity theft insurance and victim recovery assistance.

Archuleta said the agency is considering extending that to the additional 600,000 employees exposed in just the first breach and possibly going further.

“We are working very closely with our interagency partners to determine whether the services for identity theft protection should become part of a benefit that we would provide to all federal employees,” she said Thursday.

Archuleta added that there is no evidence to date that any data has been used to commit fraud, such as opening up an unauthorized credit card.

“To those that have been directly affected by this theft of information, I truly understand the impact this has on our current and former federal employees, our military personnel and our contractors,” she said. “Each and every one of us at OPM is committed to protecting the safety and security of the information that is placed in our trust. And we remain committed to do everything in our power to assist those that have been impacted by this incident.”

The National Treasury Employees Union filed the suit Wednesday claiming that the agency’s failure to protect employee information violated workers’ constitutional rights.

Lawsuit: Complaint for Declaratory and Injunctive Relief

“Federal employees must give the government a great deal of very intimate and personal information about themselves,” said NTEU National President Colleen Kelley. “Federal employees are entrusting this information to OPM with the expectation that the information … will all be kept confidential and safe. OPM makes this promise on its official background investigation forms.”

The union says OPM failed to keep this promise when hackers breached its systems, exposing employment information and background investigations on millions of current, former and potential federal employees.

OPM Data Breach: What You Need to Know

OPM Director Katherine Archuleta is named as the sole defendant in the case.

The American Federation of Government Employees filed a similar suit in late June, stating that the breach was a direct result of inaction by Archuleta and CIO Donna Seymour, who are both named as defendants in that suit.

The NTEU suit also differs from others in its legal approach.

While other suits — like the one filed by AFGE — are based on alleged violations of the Privacy Act, the NTEU suit makes the case that OPM’s failure to secure personal information violated employee’s constitutional right to privacy.

Editorial: AFGE lawsuit over OPM hack? Not a shocker

NTEU lawyers noted the Privacy Act requires plaintiffs to meet a higher standard, such as proving damages occurred and that the violation was willful and intentional.

“Our approach isn’t really focused on recouping damages,” said NTEU general counsel Greg O’Duden. “We are looking for a court injunction that will cure the source of the problem; that will ensure that OPM gets its act together and institutes appropriate security measures.”

The NTEU lawsuit asks the court to require OPM to take four specific actions:

• Declare that OPM’s failure to improve cybersecurity was an unconstitutional act;
• Order OPM to pay for lifetime credit-monitoring services and identity-theft protection for NTEU members;
• Order OPM to take all the necessary steps to heighten its IT security program and protect NTEU members’ data from falling into the hands of hackers in the future; and
• Prevent OPM from collecting personal information from NTEU members electronically or requiring them to submit such data in an electronic form until the court is satisfied with the agency’s cybersecurity upgrades.

NTEU is also asking the court to extend credit and liability protections to all current and former federal employees, not just those OPM identifies as potentially affected.

More: Feds worried insurance doesn’t cover OPM breach

As it stands, the suit would only apply to NTEU’s 85,000 members, however Kelley said there is legal precedent to extend to all federal employees and their families, were the case to succeed in court.

OPM is looking to hire four IT senior project managers to work out of the Office of the CIO, assisting with the agency’s migration to a new, modernized architecture, termed the Shell environment.

More: OPM breach a failure on encryption, detection

After news broke that millions of current and former federal employees had their information compromised in a breach of OPM’s systems, CIO Donna Seymour told Congress the new architecture is on schedule to be up and running by the fall, which will allow the agency to institute stronger security measures.

The new project managers will work directly with Seymour and the rest of the OCIO staff to move this effort forward without any gaps in functionality on OPM’s critical systems.

Specifically, the project managers will focus on maintaining and migrating legacy applications as the new architecture is put in place, including all the documentation for Congress and the Office of Management and Budget, as well.

OPM Data Breach: What You Need to Know

Applicants should have at least one year of specialized experience, as detailed in the posting on USAJobs.gov.

The full-time positions offer salaries from $121,956 to $168,700.

OPM will be accepting applications through Monday, July 13.

OPM is preparing to inform millions of current, former and potential federal employees that their information might have been exposed in the breach of background investigation data unveiled on June 8, commonly referred to as the second OPM hack.

More: Second OPM hack exposed highly personal background info

Officials confirmed the agency is planning to send out notices to all those potentially affected by the breach on a rolling basis scheduled to begin this week.

With that, the agency likely will also finally put a figure on the number of those affected, projected to be as high as 18 million by some accounts.

Information on more than 4 million federal employees was exposed in the initial breach of personnel data, however this second intrusion covers a much larger pool, potentially affecting anyone who ever applied for security clearance, including some military personnel.

OPM Data Breach: What You Need to Know

The kind of information compromised in the second breach included Standard Form 86, an intrusive form that asks applicants to disclose highly personal information, such as psychological exams and details about family and close friends.

“Thanks to the tireless efforts of my team at OPM and our interagency partners, we … have made progress in the investigation into the attacks on OPM’s background information systems,” OPM Director Katherine Archuleta said in a July 4 blog post. “I share your anger that adversaries targeted OPM data. And I remain committed to improving the IT issues that have plagued OPM for decades.”

The agency also pulled its e-QIP online submission system offline last week to fix a critical security vulnerability. Applicants for security clearances will have to file hardcopy forms for the next four to six weeks while the application is down.

More: Hang on to your security clearance forms