Pre-Summit Workshops: May 25, 2005
8:30	Registration & Continental Breakfast
9:30	Workshop A: Integrating Security into Budget Justifications OMB has recently changed their Performance Reference Model, Business Reference Model and Exhibit 300 requirements. Agencies are being asked to demonstrate and measure their performance in IT security. In order to comply with OMB and achieve full funding for your projects, it is vital for your agency to stay on top of the latest changes and aware of best practices in the security section of the Exhibit 300. • Utilize the latest business case tools and strategies to achieve full funding for your IT projects • Strengthen business cases with proven project management skills and verifi able security controls • Implement Recent Changes in OMB Guidelines to Improve Exhibit 300 Submissions
	Workshop B: Completing the Certification and Accreditation Process Certifi cation and Accreditation is a key requirement of the Federal Information Security Management Act and a requirement that can be costly and time consuming. This workshop will provide a step-by-step walk through of the C&A process using guidance from the National Institute for Standards and Technology. • Conduct a thorough assessment of management, operational, and technical aspects of information systems • Discover lessons learned from existing evaluation and validation programs • Ensure your documentation is verifi able and accurate and assess C&A quality through internal and external review
11:30	Workshops Adjourn
Day One: May 25, 2002
	PART I: Plenary Sessions
11:30	Registration and Lunch
12:15	Keynote Presentation: Implementing New FISMA Standards and Guidelines In the wake of recent events, IT security has become even more pressing, prompting swift action across the spectrum of Federal government – from new legislation moving through Congress to OMB requirements tying information security and risk management to the budget process. As a result, requirements laid out in the Federal Information Security Management Act are becoming even more stringent Attend this keynote address to hear the latest news and guidance on government security, new OMB requirements, and the latest FISMA updates. Also, discuss “what’s next” in security reform from inside the top computer security agencies. Gregory Wilshusen, Director for IT Security, Government Accountability Office
1:00	Leadership Panel: Best Practices: Planning, Building and Integrating Secure Information Systems • Strategic planning and risk assessment • Emerging standards and guidelines • Leading practices and lessons learned in implementation • Compliance with federal regulation Scott Eltringham, Office of Computer Crimes and Intellectual Property, US Department of Justice* George Bonina, Chief Information Security Officer, Environmental Protection Agency Sarah Lindenau, Director, Technology and e-Government, Council for Excellence in Government*
2:15	Break
2:30	Implementing the Federal Enterprise Architecture: Aligning Information Security with Agency-Related Missions Needs • Comply with OMB mandates to integrate security and privacy across all lines of business • Align business and management level security requirements with technical controls needed at the system level • Balance the need for information sharing with the application of security and privacy policies Laura Callahan, Business Velocity International
3:30	IT Threats Update: Responding to and Mitigating New Challenges • Prepare and respond to the latest IT security threats • Discover and apply new strategies, policies and innovations that can protect your agency and your valuable resources • Communicate the importance of IT security to endusers and stakerholders to mitigate security risks Herb Lin, National Research Academy
4:30	Conference Adjourns
Day Two: May 26, 2005
	PART II: Breakout Sessions Track One: Making the Grade on FISMA To ensure a quality score on the Federal Computer Security Report Card, agencies must implement security processes that are verifiable, cost-efficient and consistent with FISMA Track Two: Assessing and Mitigating IT Security Risk Effective Risk Management is the cornerstone of an effective IT Security Program. Attend this track to learn proven methodologies for assessing and reducing IT risk.
9:00	Keynote Address: Securing IT Funds: Integrating IT Security into Agency Budget Justifications Align your IT security strategy with your overall mission and your performance framework in order to maximize the effectiveness and effi ciency of your IT efforts and your IT dollars. Understand and implement best practices for IT security budgeting and developing performance measures. Carlos Solari, Former White House Chief Information Officer, Currently President, Solari Innovations
10:00	Track One: Making the Grade on FISMA Ensuring Agency-Wide FISMA Compliance: Improving Organizational IT Security Awareness • Identify agency training requirements under FISMA to ensure agency-wide compliance • Establish key requirements, procedures and policies for IT security • Identify competency gaps and develop and IT security training program Louis Numkin, Office of the Chief Information Officer, Nuclear Regulatory Commission Track Two: Assessing and Mitigating IT Security Risk Conducting an Effective Risk Assessment • Quantify risk in IT investments and projects • Implement strategies to reduce project risk • Apply the latest tool for determining risk-adjusted return on investment Jim Litchko, Litchko and AssociatesAl Payne, Theta Solutions
	Track Two: Assessing and Mitigating IT Security Risk Conducting an Effective Risk Assessment • Quantify risk in IT investments and projects • Implement strategies to reduce project risk • Apply the latest tool for determining risk-adjusted return on investment
11:00	Break
11:15	Track One: Making the Grade on FISMA Case Study: Improving the FISMA Reporting Process • Apply guidance for the National Institute for Standards and Technology to complete your annual FISMA report • Develop and implement a your system security plan under a risk assessment framework • Create verifiable documentation to demonstrate the effectiveness of security controls George Bonina, Chief Information Security Officer, Environmental Protection Agency Track Two: Assessing and Mitigating IT Security Risk Utilizing Applied Information Economics to Manage and Mitigate Risk • Discover the “Clarify, Measure, Optimize” approach to IT risk management and financial investment. • Utilize Applied Information Economics (AIE) to ensure the most accurate and thorough quantitative analysis of the IT risk, investment and performance measurement process • Conduct a comprehensive risk assessment for all IT assets Doug Hubbard, Hubbard Decision Research
12:15	Luncheon Keynote: Moving Forward in IT Security: A New Era in IT Security Policy Congress recently released the 2004 Federal Computer Security Report Card which revealed only slight progress being made by agencies to meet stringent FISMA requirements. To ensure that necessary steps are taken to improve our nation’s IT security, more effective guidance and policy is needed from Congress, OMB, and department decision-makers. Attend this keynote address to hear from the former Senior Staff Director for the House Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census about the next generation of policy in IT security. Find out which new requirements will be knocking at your door next. Robert Dix, Former Senior Staff Director for the Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, Now Vice President for Government Affairs, Citadel Security Solutions
1:15	Mandate Review: Achieving Compliance with Through NIST · Hear the latest news on C&A, FISMA & NIST guidance · Learn how NIST guidance can serve as a framework for risk management · Voice concerns and ask questions during a participant feedback session Marianne Swanson, Senior Advisor for IT Security, National Institute for Standards and Technology
2:5	Break
2:30	Track Three: Generating an Effective C&A Process Establishing a Cost-Efficient, Streamlined and Verifiable C&A Process • Establish transparent and verifiable C&A documentation • Reduce costs through new methods for system categorization • Examine key guidance for C&A to implement the most effective process Jim Litchko, Litchko and Associates Al Payne, Theta Solutions
	Track Four: Emerging Trends and Methodologies Establishing an Effective IT Security Program • Integrate IT security and risk assessment with your organization’s business functions • Craft effective strategy and implement performance management to achieve the most effective results • Develop a plan for implementing controls necessary to close security gaps Victoria Lord, IT Security Manager, Department of Transportation
3:30	Track Three: Generating an Effective C&A Process Case Study: Automating the C&A Process • Explore new automation tools designed to reduce time and costs needed to complete the C&A process • Fully integrate an automated C&A process with business operations and IT management • Decrease burden while increasing transparency and verifiability with a paperless system
	Track Four: Emerging Trends and Methodologies Preparing for Security Audits • Learn key techniques for ensuring security documentation is verifiable and accurate • Discover the value of using audit results as a guide for improving compliance and the need to document practices and procedures • Communicate security documentation and procedure requirements to key partners
4:30	Adjourns
Executive-Legislative IT Security Dialogue on Capitol Hill: Advancing Oversight and Policy for Results in IT Security
	How Are Government Leaders Working to Improve the Security of Our Federal Information Systems? Each year, Congress and the Office of Management and Budget each evaluate the state of IT security in Federal Government. While agencies are demonstrating continuous improvements and an undeniable dedication to protecting our nation’s vital information, critical actions are needed immediately to achieve the ambitious goals recently outlined by government leaders. Congress and OMB are demanding vast improvements for 2005! We invite you to join us as we explore the role of effective oversight and executive leadership in advancing the IT security initiative in government. The Dialogue will feature a targeted discussion between Congressional staff, agency managers, and IT stakeholders on how our Government’s leaders can better coordinate to secureour nations information systems and deliver results to the American people.
May 27, 2005
9:00	Improving Congressional Oversight in Federal IT Security
9:45	Stronger Than Ever: OMB’s Next Steps in Ensuring a Secure Government
10:30	The OIG’s Role in Evaluating IT Security and FISMA Compliance
11:15	Stakeholder Dialogue: Advancing Oversight and Policy in Government IT Security
12:00	Dialogue Adjourns