Harnessing Technology to Support Mission ContinuityAs our response to the national emergency for the coronavirus disease 2019 ("COVID19") continues to evolve, the Administration directs that agencies utilize technology to the greatest extent practicable to support mission continuity. Over the past several years, agencies have been making significant investments intechnology infrastructure, scalable technology platforms and digital delivery of mission supportand mission delivery functions. In some situations, although technical capabilities are available,agency business processes have not evolved to fully utilize these expanded capabilities. Byaggressively embracing technology to support business processes, the Federal Government isbetter positioned to maintain the safety and well-being of the Federal workforce and theAmerican public while supporting the continued delivery of vital mission services.In response to the national emergency for COVID-19, agencies are directed to use thebreadth of available technology capabilities to fulfill service gaps and deliver mission outcomes.The attached set of “frequently asked questions” are intended to provide additional guidance andfurther assist the IT workforce as it addresses impacts due to COVID-19. Additional technology-related questions should be directed to the Office of the Federal CIO at OFCIO@omb.eop.gov.OMB will continue to provide updates and additional information as needed to support theresiliency of agency missions. Office of Management and BudgetOMB_fc2d8890-ba77-4c51-bbad-1cc10871c14eMargaret M. WeichertDeputy Director for Management Federal WorkforceAmerican PublicThe Federal Government is better positioned to maintain the safety and well-being of the Federal workforce and theAmerican public while supporting the continued delivery of vital mission services._cc94dfc6-6c86-11ea-8e3a-40eb1083ea00To direct that agencies utilize technology to the greatest extent practicable to support mission continuity._cc94e0c0-6c86-11ea-8e3a-40eb1083ea00SafetyWell-BeingContinuityFlexibilityProvide maximum flexibility to agency leaders. _cc94e174-6c86-11ea-8e3a-40eb1083ea001Agency LeadersWhat flexibilities do agencies have to adjust operations to support mission delivery?OMB issued M-20-16, Federal Agency Operational Alignment to Slow the Spread of Coronavirus https://www.whitehouse.gov/wp-content/uploads/2020/03/M-20-16.pdf, which provides an overarching directive with broad latitude to provide maximum flexibility to agency leaders. _cc94e21e-6c86-11ea-8e3a-40eb1083ea00ServicesLeverage digital service offerings_cc94e2c8-6c86-11ea-8e3a-40eb1083ea002How should agencies confirm that both internal users, and the public are positioned to leverage an agency’s digital service offerings?... Additional Resources:* OMB M-17-06, Policies for Federal Agency Public Websites and Digital Services* Guidance on building better digital services in Government,https://digital.gov/resources/ WebsitesUpdate .gov websites_cc94e368-6c86-11ea-8e3a-40eb1083ea002.1Agencies are encouraged to update their .gov websites to the greatest extent practicable to provide agency service delivery information to Federal Government consumers and to direct Federal Government consumers to the appropriate digital and telephonic resources to obtain needed services.InformationProvide service delivery information to Federal Government consumers_cc94e412-6c86-11ea-8e3a-40eb1083ea002.1.1Federal Government ConsumersResourcesDirect Federal Government consumers to the appropriate digital and telephonic resources to obtain needed services._cc94e4b2-6c86-11ea-8e3a-40eb1083ea002.1.2Federal Government ConsumersUsabilityAssess the usability of its digital resources_cc94e55c-6c86-11ea-8e3a-40eb1083ea002.2We also encourage agencies to assess the usability of its digital resources, and to improve user centered design and customer service aspects of its websites, web applications, and other citizen-facing interfaces.ProductivityFacilitate personnel productivity remotely_cc94e64c-6c86-11ea-8e3a-40eb1083ea003What can agencies do to better facilitate personnel productivity in a remoteenvironment? ...Additional Resources:* Federal-Compatible Terms of Service Agreements* List of free tools that have federally-compatible negotiated Terms of Service* General Services Administration’s (GSA’s) Consolidated Federal SupplySchedule offers pre-negotiated terms of services agreements CollaborationLeverage agency approved collaboration tools and capabilities_cc94e700-6c86-11ea-8e3a-40eb1083ea003.1Agencies are encouraged to leverage agency approved collaboration tools and capabilities to the greatest extent practicable. This action may include increasing the number of licenses available, leveraging services and technologies across the enterprise, and directing specific activities to be conducted via collaboration forums.LicensesIncrease the number of licenses available_cc94e7b4-6c86-11ea-8e3a-40eb1083ea003.1.1Services & TechnologiesLeverage services and technologies across the enterprise_cc94e868-6c86-11ea-8e3a-40eb1083ea003.1.2Collaboration ForumsDirect activities to be conducted via collaboration forums_cc94e91c-6c86-11ea-8e3a-40eb1083ea003.1.3Shared ServicesMake use of collaboration tools and capabilities offered by other Federal agencies_cc94e9d0-6c86-11ea-8e3a-40eb1083ea003.2Additionally, it is recommended that agencies make use of collaboration tools and capabilities offered by other Federal agencies to meet capability gaps. Such use cannot override legal terms of service.FormsEnable remote workers to print and sign forms_cc94ea8e-6c86-11ea-8e3a-40eb1083ea004What should agencies do when remote workers need to print and sign forms? ...Additional Resources:* OMB M-19-17, Enabling Mission Delivery through Improved Identity,Credential, and Access Management* OMB M-00-15, Guidance on Implementation of the Electronic Signatures inGlobal and National Commerce Act (E-SIGN)* M-00-10, OMB Procedures and Guidance on Implementing the GovernmentPaperwork Elimination Act* The Federal Chief Information Officers Council guidance, “Use of ElectronicSignatures in Federal Organization Transactions”Printers & MediaFollow existing policies on the usage of personal printers and external media_cc94eb4c-6c86-11ea-8e3a-40eb1083ea004.1Agencies should continue to follow existing policies on the usage of personal printers and external media.Forms & SignaturesLeverage digital forms and electronic signatures to the fullest extent practicable_cc94ec00-6c86-11ea-8e3a-40eb1083ea004.2Agencies are encouraged to leverage digital methods to meet mission needs, to include leveraging digital forms and electronic signatures to the fullest extent practicable.Information CollectionsRemove impediments that may slow adoption of any new or revised information collection method_cc94ecc8-6c86-11ea-8e3a-40eb1083ea004.3When evaluating the Paperwork Reduction Act considerations associated with changes to a form or its content, contact OMB OFCIO or your OMB Office of Information and Regulatory Affairs desk officer to remove impediments that may slow adoption of any new or revised information collection method.SignatureRemove impediments to digital signatures_cc94ed86-6c86-11ea-8e3a-40eb1083ea004.3.1It is recommended that agencies identify any impediments to using digital signatures, and remove those impediments, consistent with applicable law.NotificationNotify OMB about any impediments that cannot be adequately addressed_cc94ee4e-6c86-11ea-8e3a-40eb1083ea004.3.1.1OMBOMB should be notified about any impediments that cannot be adequately addressed.Shared ServicesLeverage digital signature capabilities offered by other Federal agencies_cc94ef66-6c86-11ea-8e3a-40eb1083ea004.3.1.2In addition, agencies should consider leveraging digital signature capabilities offered by other Federal agencies to meet any technological capability gaps.Cybersecurity & PrivacyMake risk-based decision regarding security protocols, appropriate use of federal resources, and legal requirements as appropriate to meet mission needs_cc94f0a6-6c86-11ea-8e3a-40eb1083ea005Are agency cybersecurity and privacy requirements still applicable/what are some areas of focus?Security protocols, requirements regarding the appropriate use of federal resources, and legal requirements are always applicable. However, agencies are encouraged to make risk-based decisions as appropriate to meet mission needs as outlined in M-20-16, Federal Agency Operational Alignment to Slow the Spread of Coronavirus https://www.whitehouse.gov/wpcontent/uploads/2020/03/M-20-16.pdf. Areas of increased focus concerning cybersecurityand privacy include [the following objectives] ...Additional Resources:* M-13-10, Antideficiency Act Implications of Certain Online Terms of ServiceAgreements* Alert (AA20-073A): Enterprise VPN Security* GSA’s Consolidated Federal Supply Schedule offers pre-negotiated terms ofservices agreements* GSA’s Highly Adaptive Cybersecurity Services (HACS) Special Item Number(SIN) provides rapid access to key support services from technically evaluatedvendors VPN & DevicesUpdate Virtual Private Network components, network infrastructure devices, anddevices being used to enable remote work environments with the latest softwarepatches and security configurations_cc94f182-6c86-11ea-8e3a-40eb1083ea005.1ControlsProvide guidance to employees about how to ensure proper information security and privacy controls are in place when working from alternate locations or home_cc94f268-6c86-11ea-8e3a-40eb1083ea005.2ForwardingContinue to prohibit the unauthorized forwarding of Federal Government business materials or other information to personal devices_cc94f39e-6c86-11ea-8e3a-40eb1083ea005.3Social MediaContinue to prohibit the unauthorized usage of social media platforms or anyunauthorized devices for Government business_cc94f4fc-6c86-11ea-8e3a-40eb1083ea005.4Terms of ServiceConfirm that the expanded usage of technology tools is in accordance withappropriate legal considerations and does not violate legal terms of service._cc94f61e-6c86-11ea-8e3a-40eb1083ea005.5Physical AccessManaging physical access to facilities for personnel who have not been required to or may have be unable to access the facility_cc94f704-6c86-11ea-8e3a-40eb1083ea006What should agencies consider when managing physical access to facilities forpersonnel who have not been required to or may have be unable to access the facility?When managing physical access to facilities, agencies should consider the following:PIV CredentialsPrepare to accommodate personnel who are issued PIV credentials_cc94f7e0-6c86-11ea-8e3a-40eb1083ea006.1Preparing to accommodate personnel who are issued a new PIV credential or that receive a PIV certificate update during their absence from Federal facilities, and who might need to re-enroll their PIV in the Physical Access Control System (PACS) for access to the facility.* PACS that have local non-use policies may require mass re-enrollment and/orre-activation of PIV credential facility access permissions.* Agencies may need to increase the number of staff needed to support reenrollment.AppointmentsProactively schedule appointments for users to complete re-enrollment activities. _cc94f8d0-6c86-11ea-8e3a-40eb1083ea006.2FingerprintingConsider delaying the completion of fingerprinting requirements to on-board mission-critical personnel_cc94f9b6-6c86-11ea-8e3a-40eb1083ea007Office of Personnel ManagementPer the Office of Personnel Management’s (OPMs) soon to be released guidance, agencies have the ability delay the completion of fingerprinting requirements based on an agency’s risk determination and the need to on-board mission-critical personnel...Additional Resources: OPM guidance, Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12 Risk & AlternativesMake a risk determination and consider issuing an alternate credential/authenticator for PIV eligible personnel_cc94fa92-6c86-11ea-8e3a-40eb1083ea007.1PIV Eligible PersonnelAm I required to issue new personnel a PIV credential?Agencies are able to make a risk determination and issue an alternate credential/authenticator for PIV eligible personnel due to the inability to collect biometrics (e.g., fingerprints), until biometric processing is feasible.AccessConsider impacts to both physical and logical access_cc94fb8c-6c86-11ea-8e3a-40eb1083ea007.2Agencies should consider impacts to both physical and logical access whendetermining to issue a PIV eligible user an alternate credential/authenticator during this period of time.Tracking & Follow-UpTrack the issuance of alternate credentials/authenticators and prioritize the issuance of PIV credentials as soon as feasible_cc94fc72-6c86-11ea-8e3a-40eb1083ea007.3Issuance of an alternate credentia/authenticator should be tracked and a process should be established to prioritize the issuance of a PIV credential to the affected individual upon the restoration of normal business practices.Credential IssuanceWork with OMB and GSA to help resolve any issues with PIV credential issuance._cc94fd62-6c86-11ea-8e3a-40eb1083ea008What should agencies do if they are unable (e.g., low on card stock, unable to complete PIV enrollment activities) to reissue a PIV credential to personnel?Agencies are encouraged to work with OMB and GSA to help resolve any issues with PIV credential issuance...Additional Resources: GSA’s Identity, Credentials and Access Management Program Information PreparationPrepare to issue alternate credentials/authenticators if necessary_cc94feac-6c86-11ea-8e3a-40eb1083ea008.1If agencies are unable to issue a PIV credential, they should be prepared to issue an alternate credential / authenticator for physical and logical access.RiskConsider impacts to both physical and logical access when making a risk determination_cc94ffb0-6c86-11ea-8e3a-40eb1083ea008.2Agencies should consider impacts to both physical and logical access when making a risk determination on issuing a PIV eligible user an alternate credential /authenticator.Tracking & Follow-UpTrack issuance of alternate credentials/authenticators and prioritize the issuance of PIV credentials as soon as feasible_cc9500a0-6c86-11ea-8e3a-40eb1083ea008.3Issuance of an alternate credential / authenticator should be tracked and a process should be established to prioritize the issuance of a PIV credential to the affected individual upon the restoration of normal business practices.IT SystemsManage access to IT systems for personnel who have not been required to or may have be unable to access the network or specific applications_cc9501ae-6c86-11ea-8e3a-40eb1083ea009What should agencies consider when managing access to IT systems for personnel who have not been required to or may have be unable to access the network or specific applications?Agencies are encouraged to consider the following for managing access to IT systems following an extended absence from Federal facilities:Accounts & AuthenticatorsAddress expired and disabled enterprise domain/network accounts and authenticators_cc9502a8-6c86-11ea-8e3a-40eb1083ea009.1Depending on agency non-use policies and configurations, enterprise domain/network accounts and authenticators for users may expire or be disabled due to non-use.o Identifying whether enterprise domain / network account authenticator (where a PIV credential is not in use) requires re-issuance (e.g., token) or reset (e.g.,password).o Identifying accounts disabled during an absence from federal facilities, andproactively completing an account recertification with account authorizers toenable reinstatement.Local User AccountsDetermine whether Federal Government IT equipment with local user accounts will require enablement or authenticator re-issuance/reset._cc950442-6c86-11ea-8e3a-40eb1083ea009.2Identifying whether any Federal Government IT equipment with local user accounts will require enablement or authenticator re-issuance/reset.* Depending on agency non-use policies and configurations, access permissions for Government IT equipment may automatically be disabled after a period (e.g., 30 days).RemindersRemind users to access their Government IT equipment before the agency defined expiration date_cc950564-6c86-11ea-8e3a-40eb1083ea009.2.1Where possible, remind users to access their Government IT equipment before the agency defined expiration date to maintain access, during an absence from Federal facilities.Help Desk StaffingPrepare Service Help Desk surge staffing to accommodate increased volume for IT requests._cc95067c-6c86-11ea-8e3a-40eb1083ea009.3PrioritizationPrioritize ticket requests based on mission needs_cc95078a-6c86-11ea-8e3a-40eb1083ea009.2.1It may be necessary to prioritize ticket requests based on mission need.VerificationVerify users' identity and remain vigilant against social engineering attacks. _cc9508ac-6c86-11ea-8e3a-40eb1083ea009.2.2Agencies should ensure if the user is not in-person for account actions that they verify the user’s identity to remain vigilant against social engineering attacks. 2020-03-222020-03-22OwenAmburOwen.Ambur@verizon.net