In the wake of highly publicized data breaches at the Veterans Affairs Department involving mobile devices, OMB issued directives and agencies responded by encrypting laptop PCs, flash drives, and BlackBerrys and other personal digital assistants to make sure that data cannot be accessed if the devices are lost or stolen. VA was one of the first agencies to comply by applying full-disk encryption to tens of thousands of laptop PCs and later to other mobile devices. VA has also started implementing an enterprisewide security program that includes port monitoring of its network access points.

The Federal Trade Commission encrypted the hundreds of laptop PCs it owns. Like other agencies, it has fulfilled requirements for two-factor authentication for remote access, such as passwords and tokens, and a time-out function for mobile devices, said Marc Groman, FTC's chief privacy officer.

To accelerate the process to encrypt devices, OMB, the Defense Department and the General Services Administration awarded blanket purchase agreements in June under the SmartBuy governmentwide contracting vehicle. The goal is to make it easier, faster and less expensive for agencies to secure their devices. 

-- Mary Mosquera

What's not: Tracking data extracts
Unlike their fast response to endpoint security, agencies have not responded nearly as quickly to the OMB requirement to log and verify all sensitive, computer-readable data extracted from their systems. Under OMB's guidelines, agency officials must know where all their sensitive data resides, change their processes to manage it, and integrate technologies to collect and track it. 

"Depending on an agency's culture or knowledge of the sensitive data in their databases, the log-and-verify security requirement could represent a fundamental but necessary change to an agency's approach to collecting, disseminating and securing data," Evans said.

Agencies are unclear on what OMB means by data extracts and sensitive information, Groman said. Furthermore, the technology is expensive and brings implementation challenges.