Jack Jones and Warren Suss | The promise of HSPD-12
Connecting state and local government leaders
Another View'commentary: HSPD-12 isn't just a mandate; it's an opportunity.
AS THE OCT. 27 DEADLINE FOR issuing access cards to federal employees and contractors loomed last year, many information technology managers recognized an opportunity to address some of their business needs.
For example, IT managers at the National Institutes of Health realized that Homeland Security Presidential Directive 12 was more than just a security mandate with significant implementation challenges.
It directed federal agencies to do a better job of controlling physical access to facilities and logical access to data. NIH has more than 18,000 federal employees on its main campus in Bethesda, Md., and at satellite sites nationwide.
Approximately the same number of people who are not fulltime federal employees support NIH, including contractors, fellows, visitors and grant reviewers.
These members of the NIH community are not part of the centralized human resources system, but their identity and access to NIH systems need to be securely managed the same way as full-time federal employees' identities and access.
HSPD-12 was a catalyst for change at the institutes. The NIH Enterprise Directory (NED), which automated the process for registering and distributing badges to new NIH employees, needed to be revised to comply with HSPD-12.
The NIH chief information officer brought the agency's user community together to discuss required changes to NED, and the conversation led to a re-examination of the broader set of processes involved in bringing a new employee onboard.
In addition to registering new employees and issuing badges, NIH, like other federal agencies, must assign e-mail addresses, add new employees to multiple agency mailing lists, order new phones, assign new phone numbers and update the phone directory.
These processes are collectively referred to as provisioning a new employee. NIH discovered that some of its institutes had automated some of these provisioning processes while others handled them manually. There was little consistency in the approaches to process management and automation.
The agency's CIO held workshops with NIH stakeholder groups to make refinements and extensions to those parts of the NIH enterprise architecture that touched on the provisioning process.
NIH changed its enterprise architecture through a formal, facilitated business modeling process that involved all NIH stakeholder groups.
The results included clarifications in the policies and procedures for processing new employees along with the transformation of NED into a significantly improved tool to support better communication and collaboration in the broad NIH community.
The NIH response to HSPD-12 provides an important counter-example to 'The Tyranny of Federal IT' (GCN.com/875). Governmentwide and agencywide mandates too often result in the top-down imposition of poorly designed systems, counterproductive policies, and cookie-cutter solutions that don't meet unique or specialized component-organization requirements.
Instead, NIH officials made a major effort to understand stakeholder process requirements and negotiated changes to the enterprise architecture to ensure a unified system ' NED ' that accommodates the diverse needs and environments of a large, complex federal community while addressing the security requirements of a new governmentwide mandate.
Jones (jonesjf@mail.nih.gov) is the chief information officer of the National Institutes of Health, which is part of the Health and Human Services Department. Suss (warren.suss@sussconsulting.com) is president of Suss Consulting, based in Jenkintown, Pa.