Joint OCIO _ Resilience Virtual Industry Day Slides _FINAL_ January 24 2024.pdf

Opening Remarks

Jacqueline Wilks Chief, Business Relations Branch

Acquisition Program & Policy Division Office of the Chief Component Procurement Officer

Federal Emergency Management Agency 1

Opening Remarks

Scott Bowman Deputy Chief Information Officer

Office of the Chief Information Officer (OCIO)

Federal Emergency Management Agency 2

Federal Emergency Management Agency (FEMA)

Resilience/Office of the Chief Information Officer (OCIO) Industry Day

FEMA Cloud | January 2024

Resilience and Office of the Chief Information Officer (OCIO)

Industry Day

Resilience, Office of Business Management (OBM)

Presenters:

Ms. Camacho Program Analyst, Acquisitions SME

Resilience, Office of Business Management

Ms. Stephenson Program Analyst, Data Analytics SME

Resilience, Office of Business Management

Federal Emergency Management Agency

FEMA Mission: Helping people before, during and after disasters.

Resilience Mission: Resilience prepares communities, reduces suffering, and speeds recovery.

Resilience Vision: A resilient Nation where communities are prepared for today’s risks and emerge stronger for tomorrow.

Who we are: Resilience Mission & Vision

Resilience Organization

Resilience

Office of Resilience Strategy

Federal Insurance

Directorate Mitigation Directorate

Office of Business

Management

Risk Management Directorate

Office of Environmental Planning and

Historic Preservation

Grants Program

Directorate

Office of the Flood Insurance

National Preparedness

Directorate

OBM Mission: Provide expertise in preparing and managing resources to effectively and efficiently deliver the Resilience mission equitably to all customers.

OBM provides expert customer-centric support services across Resilience through data-driven analysis of shared services, including budget, human resources, acquisitions, Freedom of Information Act (FOIA) responses and coordination of training and development that advances OBM’s mission. OBM’s Divisions- Budget, Resources & Services, Workforce Development and Readiness ensure that the Resilience enterprise have the necessary resources to achieve operational results.

Office of Business Management (OBM) Mission

Acquisitions Management Support

Software & Licensing

Technical/SharePoint Services

Financial Management Support Services

Support Services, Planning, Analysis, Design & Development

Program Management Support

Administrative Support

O&M System Support

IT/Cloud Services

Cloud Engineering Support

Enterprise Strategy and Organizational Support

Customer and Data Services

Information Sharing Support

Data Analytics Software Support

Resilience/OBM Mission Requirement Areas

Leveraging Artificial Intelligence (AI), Machine Learning, and Data Governance Tools

A few examples of what we are hoping to accomplish are:

o AI to “comb” through resumes to match applicants with positions similar to those that they have applied for o AI to group applicants by the most appropriate hiring authority for hiring managers o Generative AI for creation and processing of commonly used documents (i.e. common service-based contracts, organizational spend plans and other budgetary reports).

Our Industry Ask (Artificial Intelligence and Machine Learning)

Data Intelligence Tools to Support Data Governance Efforts

Support in developing an adaptable data governance framework

A few examples of the type of work we are looking to accomplish:

o Development of a comprehensive Data Dictionary of current reports o Mapping of Data Lineage o Policy development, best practices, and change management

Our Industry Ask (Data Governance)

Contact Information:

Holley.Camacho@fema.dhs.gov Tammy.Stephenson@fema.dhs.gov

Thank you!

mailto:Holley.Camacho@fema.dhs.gov mailto:Tammy.Stephenson@fema.dhs.gov

Presenters:

Ms. Ebersole Acting Chief Information Officer, Operations Office of the Chief Information Officer (OCIO)

Mr. Fitts Acting Director, Operations

Office of the Chief Information Officer (OCIO)

Current Operations and Management (O&M) Progress

Launching Rehosting Effort

Analyzed and selected a subset of Business-Essential Systems to rehost using specific cloud solutions that meet system requirements and minimize concerns for reliance on aging, on-premises infrastructure.

Investing in a Multi-Cloud Approach

Determined that OCIO will use a multi-cloud approach for FEMA’s cloud migration with reliance and various Cloud Service Providers (CSPs) solutions and align systems to a solution based on current and anticipated system requirements.

Accomplishments

Considerations and Opportunities

Refinement of IT Processes Impacted by Cloud

Existing technology lifecycle processes (e.g. SELC and DevSecOps) will need modifications to centralize, streamline, and enable customers to maximize usage of our multi-cloud approach.

Standardize intake and SELC requirements

SOPs, processes, and requirements throughout the SELC will need to review and refresh to standardized expectations across the multiple CSPs and vendors to equip enterprise with consistent expectations for navigation cloud migration.

Operations and Management - Current Functional Areas

Federal Emergency Management Agency 15

Audio and Video

Services

Tele-communications

Operations & Maintenance

Information Technology System

Operations & Sustainment

Data Network Services

Program Management

Help Desk Services1 6

Deskside and LAN Support

Enterprise Software Support Services

1 possible future alignment

Operations and Management - Future Functional Areas

Federal Emergency Management Agency 16

Program Management

Customer Service Support1,2

Endpoint Engineering

Services2

Tele-communication

Operations, Sustainment & Enhancement

Audio and Video Services

Information Technology

System Operations, Sustainment & Enhancement

Data Network Services

Operations Engineering

Services1

1 possible future alignment 2 verbiage change

1 4 7

2 5 8

3 6 9 Enterprise Software Support

Capabilities for OCIO O&M support services will manage FEMA’S IT posture and meet the FEMA mission objectives and stakeholder needs.

Looking Ahead at Operations and Management (O&M) Capabilities

Enhanced Solutions for Disaster Recovery

Deploy cloud file and print services to provide innovative capabilities at disaster recovery sites

Ability to select from a wide range of cloud solutions using multi-cloud environments

Implement workflow automation to ease navigation of various cloud IT services through ServiceNow

Versatile Cloud Solutions

Automated Operation Processes

Provide ability to collaborate internally and with external stakeholders from anywhere on any device under both normal and disaster impacted locations

FEMA Cloud Benefits

Improved Access to FEMA Network

Centralize and automate monitoring of multi-cloud environments to enhance security of FEMA’s enterprise data and network

Monitoring and analytics platform that provides a range of features for tracking, observability, and synthetic transactions

Service Level Agreement Examples - Cloud Enablement Enterprise

Federal Emergency Management Agency 18

Measurable Period Example Performance Target

Incident Response Monthly

• Priority-1: 1 hour response time for 98% occurrences

• Priority-2 Production: 4 hours response time for 95% occurrences

• Priority-2 Non-Production: 8 hours response time for 95% occurrences

• Priority-3: 1 Business Day response time for 80% occurrences

• Priority-4: 2 Business Days response time for 80% occurrences

Network / System Latency Monthly

• Intranet (to applications)

• Intranet (between applications and users)

• Intranet (between users and applications)

Resolution Time Monthly

• Priority-1: 8 hours restoration time for 95% occurrences

• Priority-2 Production: 8 hours restoration time for 90% occurrences

• Priority-2 Non-Production: 24 hours restoration time for 90% occurrences

• Priority-3: 2 Business Days restoration time for 90% occurrences

• Priority-4: 10 Business Days restoration time based on available capacity

Production Application Availability Monthly 99.9 % Availability

New Capability / Enhancement Delivery Monthly Timely (on schedule) implementation and operation of a new capability or enhancement

Customer Ratings Monthly Feedback and ratings from customers through customer feedback and customer surveys

Recovery Time Objective (RTO) Monthly 8 hours from the declaration of a disaster

Recovery Point Objective (RPO) Monthly 2 hours from the disaster event

Contact Information:

FEMA-OCIO-Industry@fema.dhs.gov

Thank you!

Jan 24, 2024

MR. AKOUETE

Cyber Fusion Center Director

FEMA Cyber Fusion Center - FCFC Risk Management Division - RMD

Office of the Chief Information Officer - OCIO

FEMA Cyber Security Operation

Cyber Fusion

FEMA Cyber fusion is the integration of Cyber security functions under a single program.

FEMA Cyber Fusion Mission is to lead FEMA Cyber Security to a Threat Driven Cyber- Operation by integrating Cyber security related functions, such as threat intelligence, security automation/orchestration, threat detection, incident response and, Data Analytics

24 Jan 2024

Fusion Center Operational Requirements OCISO provides cyber support to FEMA’s emergency management and continuity mission by utilizing the Federal Cyber Security Framework to:

FEMA Cyber Fusion responsibility is to also provide supports to FEMA Network Operations Security Center (NOSC) by deploying advanced and modern security platform for incident handling and threat identification Provide the ability to rapidly detect and identify malicious activity, advance persistent threats (APT); to collect data and maintain metrics that demonstrate the impact of the Agency’s cyber defense approach, its cyber state and cyber security posture

Identify risks to systems, assets, data, and capabilities

Protect mission essential and critical services

Detect cybersecurity events

Respond to detected cybersecurity events

Recover capabilities or services that were impaired due to a cybersecurity event

Process

People Technology

Success

Valuable DATA FEMA Critical Asset

FEMA Mission & Critical Assets FEMA Cyber Fusion objective is to:

• Design a threat driven cyber operation with advances in

Cloud based technologies (AI/ML) to create a unified approach to threat detection, threat hunting, threat intel sharing, and data sciences

• These capabilities will allow the Fusion team to quickly identify threats and suspicious patterns, mitigate them more effectively to reduce mean time to respond (MTTR) .

• We can consolidate and conduct comprehensive analysis of threat data obtained from classified, third party, and open-source resources to provide indication and warnings of impending attacks against FEMA before they impact FEMA.

Fusion Center Operational Requirements

• Digital Media Analysis (DMA)

• Incident Response (IR)

• Cyber Threat Intelligence (CTI)

• Threat hunting

• Threat and data Analytics

• Threat Detection

• Systems Integration

• INNOVATION

Cyber Security Response Services Minimum of a Top-Secret Clearance with SCI Eligibility

CFC - Enterprise Risk Management

• For the last few years, FEMA is proud of keeping its Continuous

Diagnostics and Mitigation (CDM) score card green and to be one of the top at DHS

• This success is due to the dedication of all FEMA IT staff and good investment in IT & Cyber operations in the last few years to quickly Identify and mitigate risks.

• We need to continue implementing controls to reduce or eliminate risk as much possible based on a sound ROE analysis

Continuous Diagnostics & Mitigation Program Data Flow from Agencies to the Federal Dashboard

Image Source: GAO analysis of Department of Homeland Security data | GAO-20-598

ZT Directives Guiding Directives

• To comply with the OMB Mandate,

• Our Zero Trust architecture must address improvements in every area of FEMA IT operation…we intend to improve upon our current security posture in all 5 ZT pillars.

• Posture FEMA to Meet Current and Emergent Threats challenges

• Build a strong identity and data protection Solution

ZT Drivers Map

ZT Framework NIST.SP.800-207

EO-14028

M22-09 ZT

Identity Device Network Application Data

M-19-17

ICAM

NIST.SP.800

-157

NIST.SP.800

-162

M-22-01

EDR

M-22-05

FISMA

M-21-07 IPv6

M-19-26

TIC

M-15-13

TIC

M-22-01

EDR

NIST.SP.800

-92

M-21-30

CRIT SOFT

M-20-32

VDP

BOD

20-01

NIST.IR.83

Compliance & Opportunities Strategic Goals:

• Focusing efforts on key protection gaps and leveraging capable controls in existing architecture allows for a repeatable process that carries IT, security, and the business along on the journey

FEMA IT Strategic Implementation Plan

• We can Leverage advances in technology to modernize FEMA and migrate to a secure cloud-based Zero Trust network architecture

• Implement improvements that will result in cost efficiencies and reductions in IT complexity

A successful zero trust implementation should involve a combination of solutions, protecting the data, applications, assets, and/or service elements.

Akomala.Akouete@fema.dhs.gov

Thank you!

CONTACT

mailto:Akomala.Akouete@fema.dhs.gov

QUESTIONS AND ANSWERS (Q&A)