OMB to industry: Give us insight, not brochures

Promotional materials aren't going to sell the Office of Management and Budget on how a vendor can best consolidate and standardize IT security, said John Sindelar, OMB's Line of Business Consolidation initiatives program executive.

Brochures should be a part of the appendix, not part of the answers to the General Services Administration's request for information released earlier this month, Sindelar said yesterday during a Cybersecurity Line of Business industry day in Washington.

"We are not looking for vendors to sell us something, but want their successes and failures when standardizing certain IT security functions," Sindelar said. "Different solutions will come from the business case we are putting together, and we will consider everything from outsourcing to centers of excellence to whatever works best."

The Cybersecurity LOB task force will develop one or more business cases and send them to agencies for review. The group will submit the recommendations to OMB by Sept. 1, in time for the fiscal 2007 budget request.

Part of the line-of-business work is figuring out how much agencies are spending now on the five functions: program management; security considerations in the information systems lifecycle; situational awareness and incident response capability; training and knowledge sharing; and selection, evaluation and implementation of security hardware, software and services.

OMB asked agencies for estimates on these costs to set the baseline for potential savings, Sindelar said.

"We want to create a gap analysis," he said. "The task force then will look for ways to close the gaps through common solutions."

Glenn Schlarman, OMB's chief of the Information Policy Branch in the Office of Information and Regulatory Affairs, said his office estimated that agencies are spending about $2 billion on common processes.

"If we can consolidate or make the processes more economical, we can save money or gain some cost avoidance," Schlarman said.