Most agencies miss HSPD-12 deadline

Friday - 10/31/2008, 6:13pm EDT

By Jason Miller
Executive Editor
FederalNewsRadio

The Office of Management and Budget today issued the latest results of agency efforts to meet Homeland Security Presidential Directive-12.

OMB says agencies issued more than 1.5 million secure identification cards to employees and contractors, including more than 300,000 since Sept. 1.

But more than 2.5 million employees and contractors still need HSPD-12 cards.

About half of the major agencies, including the departments of Education, Defense, Housing and Urban Development, Labor, State and Treasury, met their agreed upon targets to issue cards under the initiative.

Other agencies that OMB highlighted as doing well include the Environmental Protection Agency, NASA, the National Science Foundation, OMB and the Social Security Administration.

Karen Evans, OMB's administrator for e-government and information technology, says these agencies should be commended for meeting their goals.

"NASA was at less than 10 percent in the last publicly released report," she says.

"They really cranked up all the work they have been doing. They now are at 93 percent. In my book that is an A."

Three agencies, the General Services Administration, the Small Business Administration and the Agency for International Development, also received kudos for implementing the HSPD-12 badging process into their human resources procedures for new employees, Evan says.

GSA, SBA and AID were not among the agencies that met their milestones.

Interesting two agencies missing from the list of agencies meeting their targets were the departments of Justice and Homeland Security.

OMB says Justice and DHS did not meet their targets.

One industry expert, who requested anonymity so they could speak more freely, says Justice and DHS performance is embarrassing because HSPD-12 is a homeland security program at its core.

"On this initiative, they should be leading it and should be example to the rest of government," the industry expert says. "There was a plan asked for DHS to be at 80 percent done by this December. They are not 1 percent."

The expert adds if DHS been out in front on HSPD-12 that experience and leadership would have benefitted its other identification card initiatives such as Real ID and the Transportation Worker Identification Card (TWIC) programs.

A DHS spokesman says the department issued about 1,200 cards mostly to headquarters employees. DHS has about 200,000 employees.

The spokesman says DHS is on target to meet its 2010 goals as outlined in its OMB approved plan.

Justice issued 2,008 cards to employees as of Sept. 30. They have about 80,000 employees overall.

A Justice spokeswoman says her department has been piloting HSPD-12 at headquarters before expanding it to other bureaus.

"[The pilot] allowed all 12 badging entities to benefit from the lessons learned and increased maturity and stability of the GSA managed service over the pilot period and reduce the impact of the learning curve on existing business process and operations," the spokeswoman says.

"DOJ plans to complete badging of National Capitol Region employees and contractors early in the first quarter, 2009. DOJ plans to complete badging of 80-90 percent of its outside National Capitol Region employees and contractors during 2009."

Justice also is testing a logical access control with digital signatures and encryption, she says.

Evans says OMB is working with these and other agencies on their corrective action plans.

OMB says most agencies will meet their goals by the second quarter of 2009 if they follow their corrective action plans.

"This is not acceptable performance," Evans says. "They said they would hit their target and they didn't. We are taking the appropriate next steps just like any other department that didn't hit their milestones."

Corrective action plans are due to OMB by Nov. 17 detailing how agencies will meet HSPD-12.

Evans says OMB also is working with agencies to begin using the cards. Many agencies have focused on physical access control, but Evans says they need to start seriously considering logical access control too.

"We are saying 'How are you doing two-factor authentication and what are you using as second factor?'" she says.

"We have been working with agencies and encouraging them to use HSPD-12 card as the second factor."

---
On the Web:

ID Management.gov - Agency HSPD-12 progress reports

OMB - HSPD-12 progress report press release

(Copyright 2008 by FederalNewsRadio.com. All Rights Reserved.)