Lack of deadline slows adoption of Trusted Internet Connections

As of June 10, only one of four carriers, AT&T, have received the governmentwide authority to deliver Managed Trusted IP Services to any federal agency under the General Services Administration’s Networx telecommunications acquisition.

GSA’s Federal Acquisition Service (FAS) Office of the Chief Information Officer last week issued AT&T its governmentwide authority to operate or ATO. But it likely will be months before Qwest, Sprint and Verizon get similar official go-aheads.

It is FAS — and not GSA’s Integrated Technology Services, which handles network services programs — that “oversees the certification and authorization process and performs the required security testing and evaluation,” said Karl Krumbholz, ITS network services programs director.

The ATO came, in the case of AT&T, six months after Homeland Security Department approved its MTIPS plans. The deadline for agencies to transition services from FTS2001 to Networx is now less than 12 months away, and GSA officials, among others including Congress, have been vocal in their criticism of agencies’ perceived footdragging.

Even via e-mail comment, it’s not hard to detect some bristling by FAS CIO Elizabeth DelNegro at any suggestion that GSA is slacking on the certification and authorization (C&A) process.

“The FAS OCIO is working with the Networx contractors to complete their C&As,” she wrote. However, “the C&A schedule is dependent upon the Networx contractors. FAS OCIO cannot start until we receive their completed packages.”

Only AT&T had submitted “final packages for review, testing and subsequent issuance of ATO,” she said. “We are waiting for the rest of the contractors to submit their packages.”

The process is new and complex, and “like any new thing, it takes time [on both sides] to get everything in order,” said Diana Gowen, senior vice president and general manager at Qwest Government Services.

“Just when you think you’ve got a process nailed, someone will say, ‘Oh, but what about this?’ and you have to go back and deal with it. It’s an iterative process, ” she said. 

In the latest iteration, Qwest appears to have submitted its final package for review.

DelNegro said that Qwest's certification and authorization process is scheduled for Thursday, June 10.”=

Gowen is optimistic about Qwest’s chances of getting quickly through the process. “We were the first to get DHS authorization for our MTIPS solution, and that part of it didn’t take an inordinate amount of time,” she said. “So, we’re hopeful that, given how long it took AT&T to get this done,” our GSA ATO will follow soon.

Until then, Gowen said, “our strategy is to go to each individual agency that wants to do MTIPS with us and get the ATO from them, which is what we did with Tax and Trade.”

That’s the Treasury Department’s Tax and Trade Bureau, and that ATO — the first MTIPS ATO of any kind — came in May, said Qwest spokesman Tom McMahon.

Getting an ATO from GSA is handy, but not absolutely necessary. It’s “intended to allow [agencies] to use the service without having to do their own ATO,” Krumbholz said. “If they choose to do their own, that is their decision.”

MTIPS is the Networx implementation of the Office of Management and Budget’s mandate for the Trusted Internet Connections initiative.

Several other agencies also have contacted Qwest about MTIPS, McMahon said.

“The Federal Energy Regulatory Commission has given us an order for MTIPS, and they will give us an ATO,” Gowen said.

But until OMB sets a deadline for implementing TIC, most agencies are reluctant to commit the money.

“That’s one of the big issues now with many agencies,” Gowen said. “It’s something of a conundrum for all of us. We all know that cybersecurity is very important, but many agencies look on [TIC] as an unfunded mandate. And if they don’t have a line drawn in the sand that says ‘by this date they actually have to have this done, they keep putting it off.”

In a memo Sept. 17, 2009, federal CIO Vivek Kundra OMB gave agencies a Sept. 25, 2009, deadline to submit to DHS plans of action and milestones for implementing TIC and provide updates at six month-intervals thereafter.

The memo specified that agencies that chose to provide their own TIC services had until that date to also schedule initial TIC compliance on-site assessments by DHS. Other agencies had until Dec. 31, 2009, to submit their initial TIC compliance self-assessments.

Agencies planning to buy TIC (MTIPS) services via Networx had until Sept. 30, 2009, to estimate costs of that option.

OMB officials have maintained that, while agencies are expected to fulfill the terms, including milestones and deadlines, of TIC implementation plans they submitted, as of yet, no hard and fast deadline is in the pipeline.

Some agencies are moving ahead with MTIPS implementations, however. GSA’s Office of the CIO released an MTIPS statement of work to Networx vendors in August, and the U.S. Patent and Trademark Office released one in February. Two other MTIPS SOWs — from the Executive Office of the President and the Nuclear Energy Commission — are currently under revision by GSA.