The US Department of Veterans Affairs - Essay Example

? Information Security Program Survey: US Department of Veterans Affairs (VA) Executive summary The United s Department of Veterans Affairs (VA) is government powered departmental system for providing services for the wellbeing of military veterans, their families, and survivors. It is the second largest department of the US Federal government and currently employs approximately 280,000 people. VA mainly runs medical facilities and benefits officers for veterans and is responsible for managing the administration programs of veterans and their dependants. As described in its website, VA is one of the world’s largest consolidated IT organizations and the department’s Office of Information Technology has a $3.1 billion budget for the current fiscal period. The organization operates nearly 800 community based outpatient clinics and 152 medical centers. In addition, it possesses over, 300,000 desktop computers, 30,000 laptop computers, and roughly 450,000 email accounts (CRISP). Recently, the VA has implemented the Continuous Readiness in Information Security Program (CRISP) to enhance the privacy of information about Veterans and their families. This information security program greatly fits the VA’s FY 2010-2014 strategic plan because this program notably contributes to value optimization and stakeholder satisfaction. However, the organization has been performing poorly in major information security control areas for long years. This issue has limited the performance efficiency of the CRISP to a certain extent. The costs and benefits of the CRISP development and execution are yet to be known. VA’s Strategic Plan The VA strives to be people-centric, result-driven, and forward looking (VA strategic plan). All operations of the department are directed towards promoting the wellbeing of Veterans and their families. The department evaluates its performance on the basis of accomplishments but not promises and it continuously tries to deliver better improved services with available resources. For the financial years 2010-2014, the VA has designed a specific strategic plan, which aims to achieve a set of strategic goals. As stated in the strategic plan refresh (2011-2015), one of the major goals of this strategic plan is to enhance the health care quality and accessibility and to improve benefits and memorial services along with value optimization. It also aims to meet Veteran client satisfaction by delivering improved ‘health, education, training, counseling, financial, and burial benefits and services’. Another key objective of FY 2010-2014 strategic plan is to improve the willingness to deliver services and to protect people and their properties on a continuous basis, and particularly in times of crises. Finally, this strategic plan also strives to “improve internal customer satisfaction with management systems and support services to achieve mission performance and make VA an employer of choice by investing in human capital” (VA strategic plan). Information security program The VA has established the Continuous Readiness in Information Security Program (CRISP) by coalescing different information security initiatives. The major purpose of this program is to strengthen the security of information about Veterans, particularly health care records. This information security program is characterized with “unannounced audits, surveys, and self-assessments” (CRISP). The department claims that this program is very effective to ensure the confidentiality of sensitive information about Veterans. Actually, CRISP began as an initiative to ensure the department’s 334,000 employees 100 percent comply with mandatory security and privacy awareness training. The CRISP is completely in line with the department’s “long-standing security policies, including the provision of consistent, centralized training on IT security, records security, and privacy awareness”. The most part of the training is based on internet. In addition to following the traditional policies, the new policy initiatives also include innovations like ‘mandatory signature on Rules of Behavior’, and loss of IT privilege for employees who do not complete the annual training. This information security program provides tools necessary to normalize CRISP practices at the department’s local offices (CRISP). Strategic Fitness It seems that the CRISP greatly supports the goals and objectives of VA. It is clear that the department stores abundant information regarding Veterans and their family members in order to provide them with improved services. Evidently, this information may include health records and financial records that are highly confidential in nature. Hence, it is the responsibility of the VA to ensure the privacy of Veterans’ sensitive information and to serve their needs well. As discussed already, CRISP assists the organization to promote the security of Veterans’ personal information and hence to meet Veteran satisfaction, which is one of the ultimate objects of the FY 2010-2014 strategic plan. Evidently, increasing the confidentiality of Veterans’ personal information would contribute to value optimization, which is another key objective of the VA’s strategic plan. Today, cyber security issues are growing to be a potential threat to large organizations due to increased prevalence of computer hacking activities and malware attacks. At this juncture, it is vital for huge organizations like VA to have a separate system for improving cyber security. As this information security program provides specific training for VA employees, they can be easily familiar with the CRISP practices. As experts point out, the CRISP may enable employees to secure personal properties of members in time of crisis. Finally, this newly implemented information security program can benefit the organization to achieve mission performance and to meet stakeholder interests effectively. In short, CRISP would add value to the operational efficiency of the organization. For long years, the VA has been struggling with securing its information and systems and this issue raises potential challenges to the department’s operations today. Although the organization has taken several initiatives over the recent years to strengthen its information security practices, shortcomings in the implementation significantly limited the effectiveness of those initiatives. According to the GAO Federation Information System Controls Audit Manual (2010), VA has been consistently performing weakly in all the five areas of information security control such as access control, configuration management, and segregation of duties, contingency planning, and security management. The IT security and control weaknesses have placed the organization’s programs and financial data at risk (United States Government Accountability Office, 2010). Naturally, such shortcomings have notably affected the performance of the CRISP. CRISP was launched very recently in 2010 and therefore the actual benefits of this information security system have not been stated. Similarly, the accurate costs associated with the development and implementation of this program are not known. However, it can be stated that the benefits of this CRISP would outweigh its costs if the program is executed and monitored properly. Name of the organization and URL: U.S Department of Veterans Affairs http://www.va.gov/ Name of the security system you are evaluating: Continuous Readiness in Information Security Program (CRISP) Which Act of Congress does this support or which law or initiative does this support? Federal Information Security Management Act of 2002 Name of the strategic plan: FY 2010-2014 strategic plan Costs and benefits from the strategic plan: Not available Identify your results in the report: The CRISP greatly fits the strategic plan of the VA Overall analysis: This information security program can meet the strategic goals of VA if it is implemented and monitored properly. SWOT Matrix Strengths Weaknesses Opportunities Threats Enhancement of value optimization and customer satisfaction Absence of a strong IT platform Growing management attention to the area of information security Poor performing information security control areas Improving the reputation of the organization Employees are not familiar with this program Increasing technological innovations Increased government assistance Contributing to VA’s operational efficiency. A potential workforce containing IT experts Growing threat of computer hacking and malware attacks Improving people’s confidence in VA Huge investments in IT infrastructure Employee resistance to change References CRISP. US Department of Veterans Affairs. Retrieved from http://www.bronx.va.gov/features/CRISPexplained.asp United States Government Accountability Office. Information Security. Veterans Affairs Needs to Resolve Long-Standing Weaknesses. VA strategic plan refresh. Fiscal Year 2011-2015. US Department of Veterans Affairs. Read More