Federal Railroad Administration

1. Federal Railroad Administration FY 2003 E-Government/IT Strategy February 6, 2003 This document is business sensitive, and is intended solely for the use and information of the Department of Transportation. Federal Railroad Administration

2. Agenda Overall FY 2003 Federal Railroad Administration E-Gov/IT Strategy FY 2003 Federal Railroad Administration Security Plan Key Challenges And Risks Emerging Opportunities For Cross-Cutting IT Projects/Technologies Conclusion/Other Issues Federal Railroad Administration E-Gov/IT Action Plan

3. Overall FY 2003 Federal Railroad Administration E-Gov/IT Strategy ► Approach.This E-Gov/IT Strategy represents the approach that FRA will take to implement IT policy and programs on a coordinated basis. This strategy also is designed to work synergistically within and between these programs, such that IT is then leveraged more effectively and efficiently as FRA implements the President’s Management Agenda (PMA). ► Mission Support.The mission of FRA is to ensure that our Nation has safe, secure, and efficient rail transportation that enhances the quality of life for all. FRA intends to advance rail transportation through organizational excellence, integrity, and professionalism, and it is recognized that DOT and FRA increasingly rely on information to perform their public mission. ► Strategic Goals.The FY 2003 E-Gov/IT Strategy is a key policy implementation statement that will significantly effect the accomplishment of the DOT strategic goal of “Safety” and FRA’s strategic goals of: Safety, Mobility, Economic Growth, Security, Human and Natural Environment, and Organizational Excellence. ► Governance.FRA has already begun to realize the benefit of having coordinated IT policy and an E-Gov/IT overarching implementation strategy that complies with agency, DOT, and Federal directives. This includes support for agency strategic planning, capital asset management (including the emergence of cost accounting practices), workforce planning, and program management. PMA-related benefits of having an E-Gov/IT Strategy are already being realized in the areas of “Budget and Performance Integration” and “Expanding E-Government.” ► Investment.Specifically, this includes the development of a comprehensive view of over $8M in IT investments through the implementation of an IT Capital Planning Process in late 2002. This investment view of twenty-two IT projects and support contracts also served to coordinate and promote the 2003 update of the FRA Enterprise Architecture (first completed in August 2001) as well as enabling the prioritization of IT security certification and accreditation (C&A) activities during 2003-2004. ► Culture and Stakeholders. What is unique perhaps about FRA’s approach to E-Government, is that from the start Program Sponsors and Project Managers have had an active role in related initiatives. While change management is always a challenge, this type of interaction and multi-stakeholder buy-in will be key to the ongoing success of the E-Gov/IT Strategy. FRA has a very active Union voice from AFGE 2814. The impact and implementation of IT decisions are negotiable. Federal Railroad Administration E-Gov/IT Action Plan

4. FY 2003 Federal Railroad Administration Security Plan ► Operational Security. FRA has maintained an effective IT Security Program at the operational level for many years. During Fiscal Years 2001 and 2002, FRA has consolidated its network infrastructure and implemented new, more robust security solutions for applications, databases, websites, and network components. ► Security Positions and Training. In 2002, FRA designated and trained an Information Systems Security Officer, identified the Designated Approval Authority (FRA CIO), achieved 100% security awareness training among end-users, and hired a management consulting firm to make recommendations on improving the IT Security Program and assist in the finalization of and future updates to the draft FRA IT Security Plan. ► Security Planning and Assessment. In January 2003 a draft FRA IT Security Plan was completed, and during the rest of FY 2003 FRA will complete IT Security Risk Assessments and develop IT Security Plans for over a dozen IT systems. FRA will also complete the DOT/NIST C&A checklist for those systems identified as being mission critical. The remaining non-mission critical IT systems will be certified in FY 2004. ► Assigned Personnel. FRA has two government personnel and one contractor performing IT security duties. By mid-2003, this will expand to approximately two government and five contractors as C&A activities commence. ► Challenges. The main challenge in meeting DOT Scorecard goals for IT Security has been a lack of funding, which delayed the commencement of certification and accreditation activities as well as the development of system-level Security Plans. Federal Railroad Administration E-Gov/IT Action Plan

5. Key Challenges And Risks Key challenges for the implementation of the E-Government/IT Strategy beyond FY 2003 include: ► Managing Change. The concepts of E-Government remain difficult to understand both clearly and meaningfully to many executives, managers, and staff. Even though many Program Sponsors and Project Managers have been involved from the start in the implementation of E-Government related initiatives, there remains a fair amount of skepticism and a reluctance to commit resources. The PMA’s identification of “Expanding E-Government” helps to show the Administration’s commitment to this area, but it continues to sometimes be difficult to translate that to program-level commitment, cooperation, and change in processes as architectures are established, new business line approaches are suggested, investment planning is centrally coordinated, and security effectiveness is increased. ► Funding for E-Government Programs. (e.g., Architecture, Security, GPEA) Federal law on IT management reform over the past seven years has largely been an unfunded set of new mandates for policies and programs. As such, many agencies, including FRA, have had to use the multi-year budget process to establish budget lines for new programs such as Enterprise Architecture and IT Security. Funding for these two IT programs in particular took over two years to establish in amounts sufficient to support an effective level of activity and train personnel in the associated competency areas. IT project management emerged during 2002 as an area which needs particular attention in the areas of training, planning proficiency, and reporting mechanisms. To address these funding and training issues, FRA has more than tripled its Enterprise Architecture funding in FY 2003 (over $450K budgeted), and in this FY has a budget line for IT Security for the first time (over $350K budgeted). ► Training. Additional training is needed for program and project managers to facilitate increasingly accurate and comprehensive business cases, architectural documentation, and security solutions. A training workshop for more than twenty IT program and project managers was held in October and in January the workshop was repeated for four acquisition and contracting specialists. More of this is needed. Federal Railroad Administration E-Gov/IT Action Plan

6. Emerging Opportunities for Cross-Cutting IT Projects/Technologies ► Cross-Cutting Project Opportunities. FRA is involved in several IT projects/technologies that could potentially be leveraged among two or more DOT organizations. This includes our “E-Learning” project, and the “Inspection Data Download Page” that is part of our Railroad Inspection Reporting System and could be viewed as a model for supporting this type of safety activity in several OA’s. E-Learning Project: During FY 2002, FRA successfully completed two E-Learning trial programs using the Internet. The initial courses provided a 3-day certification curriculum and annual refresher COTR training using free material provided by the Federal Acquisition Institute, including lectures and exams. The second course provided Computer Security Awareness training to all FRA employees using the Internet to show a film using streaming video technology. FRA employees answered test questions on-line and provided verification that they had completed the training. FRA Learning Express is on the horizon. Inspection Data Download Project: During FY 2003, FRA will develop a data download web site to give railroad industry members of the Railroad Inspection Reporting System (RSIS) access to their own proprietary inspection activity data. To ensure system integrity, Privacy Act and Whistleblower Act information contained in the system will be protected. This eliminates the need for industry members to duplicate the data entry between RSIS and their own systems and ensures that the same information is on record. ► Enterprise Licensing and IT Standards. FRA is participating in the DOT Enterprise Licensing Agreement, as exemplified by investments in MS Office, MS Exchange, and MS Project applications. By migrating to MS Exchange in FY 2001, FRA is already in compliance with what it understands to be the DOT standard at the application sub-architecture level for e-mail delivery systems. Architecture discussions on database standards and preferred products (e.g., Oracle and SQL) are ongoing in such a manner as to support DOT OCIO standards and promote intra and inter OA sharing of safety, compliance, and governance information. ► Potential Cost Savings. Opportunities for cost savings at FRA include the identification of potentially duplicative network, system hosting, and database solutions for both office automation and program office (operational) systems, but confirmation of these opportunities will come later in FY 2003 as control and evaluation reviews are completed for all twenty-two IT projects and support contracts via the FRA IT capital planning process. Federal Railroad Administration E-Gov/IT Action Plan

7. Conclusion/Other Issues The primary ways that DOT (OCIO/S-80) can help FRA and other OAs get to and stay “green” in E-Government/IT Strategy areas would be to: ► Coordinate with OST points of contact on each of the other four President’s Management Agenda initiatives prior to pushing requirements down to the OAs. Develop a Master Mapping Plan that integrates all five PMA initiatives. ► Continue to provide examples for policy, program documentation, best practices, and schedules. ► Provide multi-OA training workshops on enterprise architecture, project management, capital planning, security, and workforce planning. ► Coordinate and sponsor acquisition contracts that all OAs can participate in. Encourage the use of GWACs and the FSS. ► Implement cost accounting practices as part of capital planning. ► Provide paid-for “subject matter experts” from industry at key planning and reporting points. Federal Railroad Administration E-Gov/IT Action Plan