Adapting to and Overcoming Supply Chain Disruptions During the Pandemic- An Allegient Defense and CIGIE Success Story

The Council of the Inspectors General on Integrity and Efficiency (CIGIE) is an independent entity established within the executive branch to address integrity, economy, and effectiveness issues that transcend individual Government agencies. The Council aids in the establishment of a professional, well-trained, and highly skilled workforce in the Offices of Inspectors General. CIGIE’s membership is comprised of all Inspectors General whose offices are established under the Inspector General Act of 1978, as amended, 5 U.S.C. app, as well as:  

• The Controller of the Office of Federal Financial Management  
• A designated official of the Federal Bureau of Investigation 
• The Director of the Office of Government Ethics 
• The Special Counsel of the Office of Special Counsel  
• The Deputy Director of the Office of Personnel Management 
• The Deputy Director for Management of the Office of Management and Budget 
• The Inspectors General of the Office of the Director of National Intelligence, Central Intelligence Agency, Library of Congress, Capitol Police, Government Publishing Office, Government Accountability Office, and the Architect of the Capitol 

Allegient Defense plays a key role in CIGIE’s FISMA Remediation Project. The Federal Information Security Management Act (FISMA) is a United States federal law that was passed in 2002 (amended in 2014) requiring Federal Agencies to develop, document and implement an information security and protection program. These changes resulted in less overall reporting, strengthened the use of continuous monitoring in systems, and increased focus on the agencies for compliance and reporting that is more focused on the issues caused by security incidents. In support of and reinforcing FISMA, the Office of Management and Budget (OMB) through Circular A-130, “Managing Federal Information as a Strategic Resource,” requires executive agencies within the federal government to: 

• Plan for security 
• Ensure that appropriate officials are assigned security responsibility. 
• Periodically review the security controls in their systems 
• Authorize system processing prior to operations and, periodically thereafter. 

The CIGIE Enterprises that Allegient Defense supports are located in two locations: Washington, D.C. and the Federal Law Enforcement Training Center (FLETC) in Brunswick, GA. The FISMA remediation project is complex, involving Technical Analysis, Technical Design, and the implementation and remediation services required to resolve CIGIE’s FISMA-related deficiencies at both locations; this includes an upgrade of their current system which resided both onsite and in multiple clouds. Our team consolidated CIGIE’s legacy outdated servers into the Government Azure Cloud and upgraded servers to not only reduces the risk of security concerns, but ultimately enhance the availability of access to the systems at both the headquarters and FLETC locations. 

CIGIE awarded the contract to Allegient Defense based on tried and tested expertise in system modernization and cybersecurity. In Accordance With (IAW) FISMA Quarterly reports, CIGIE recognized the need for implementing a robust FIPS-201 HSPD-12 (Personal Identity Verification Standard and Homeland Security Presidential Directive-12) system which allows them the flexibility to issue out Personal Identification Verification (PIV) cards for all authorized students, guest and detailees from other agencies. This also includes the ability to issue security certificates to servers and workstations when joining the network and authenticating through a Virtual Private Network (VPN). As most agencies across the government now offer the flexibility of either a physical network connection or a wireless connection, the need for added security is paramount and still maintain normal day to day operations. There are many challenges to keep in mind when setting up wireless networks, for instance: Primary Wireless and Guest Wireless. Primary access provides connectivity for all persons who meet a predefined set of pre-requisites—to include physical equipment, security certificates, and access control membership—before access to the network is granted. Guest Wireless allows the guests of the agency internet access and internet access only, separating their traffic is from the agency traffic. 

Our team set these systems up at both CIGIE locations to meet the strict security requirements, including agency sponsorship and approval prior to guests being authorized to connect wirelessly. Through multiple Network Access Controls (NAC), the CIGIE IT Staff are notified when guest users are requesting access, devices are quarantined through network device detection protocols. During the COVID-19 pandemic, this was a difficult task due to supply chain shortages, teleworking and limited access to government buildings. With the need for added security measures for the telework staff, there were unforeseen requirements that led to unplanned upgrades to CIGIE’s networks firewall system to ensure that all CIGIE’s users and data maintain current state of Confidentiality, Availability and Integrity (CIA). However, our team of professionals acted quickly to procure, configure and implement a new firewall system in just a matter of a few weeks. 

Allegient Defense is likewise primed to support developing COVID-19 initiatives. In the beginning phases of the contract, the Pandemic Response Accountability Committee (PRAC) was established as a committee of CIGIE by the CARES Act. PRAC’s primary function is to provide and promote transparency, support, and independent oversight of the funds provided by the CARES Act and all related pandemic relief legislation in response to the outbreak of the Coronavirus. The CIGIE and Allegient Defense team recognized the importance of this committee and the possible expansion of CIGIE’s current network and security infrastructure to support the PRAC if the need arose—a critical step in the development being proper initial authorization processes and risk assessment. In order to keep networks safe and secure against adversaries, they go through a rigorous Authority to Operate (ATO) process and Risk Managed Framework (RMF) that is ultimately signed off by the Chief Information Officer (CIO).  

To support these efforts, Allegient Defense works directly with the CIGIE CIO through the ATO/RMF process ensuring all agency security protocols meet or exceed expectations for their environment. FIPS 199 and NIST 800-53 (National Institute of Standards) is used as the basis for all required security controls and control implementation across a broad spectrum of families (Audit, Access, Training, Program, Information Assurance, Disaster Recovery, Media Handling, etc.). Allegient Defense brings a wealth of knowledge to the environment from Department of Homeland Security, as we have achieved and maintained full ATO status for a similar network status and size. CIGIE and Allegient Defense have worked closely together to ensure proper Secure Baselines, DISA STIG (Security Technical Implementation Guides) are properly applied across the network to mitigate any security vulnerabilities on servers and workstations and verified through network security scans. In addition, the ATO/RMF package for CIGIE required initial implementation of the following plans to meet NIST and FISMA requirements: System Security Plan, Disaster Recovery, Continuity of Operations, Incident Response, Contingency Plan, Plan of Action and Milestone Management Plans, and Program Management. Policy and Procedures documents are required to further enhance these plans. 

Allegient Defense’s FISMA Remediation team takes great pride in its effective and high-quality implementation and upgrade to the CIGIE infrastructure and Security Authorization. Due to COVID-19, this is still an ongoing process; however, our team has learned to adapt, overcome, and outperform when faced with these unforeseen challenges. Our consistent results demonstrate the quality that allows our team to remain a contractor of choice in support of the ongoing CIGIE mission.