Almost a year after the Office of Personnel Management started reorganization, the reform remains as a challenge for the agency and its partner organizations. A new report issued Tuesday by the Government Accountability Office highlights that OPM, the Office of Management and Budget and the General Services Administration failed to implement proper reform efforts, including an implementation plan. 

The Trump administration proposed moving responsibilities of OPM to other agencies in June 2018. The agencies working on the program did not establish outcome-oriented goals, a cost-benefit analysis and coordination with Congress, employees and other key stakeholders. GAO also found OPM and GSA did not develop plans to address management challenges that may affect the reorganization.

“As the Congress and administration consider whether or how to restructure OPM, it will be important to retain the capacity to execute certain government-wide, strategic human capital functions, regardless of the decision made about the organizational arrangement,” GAO said. 

A memo says the U.S. Air Force reported intrusion of its network using malware and is investigating the U.S. Navy with regard to the latter’s possible involvement in the cyber attack, Air Force Times reported Tuesday.

Navy Capt. David Wilson, chief of staff for the military branch’s defense service offices, wrote in the memo that a Navy prosecutor involved in a Navy SEAL’s war crimes case in San Diego used tracking software to trace emails sent to defense lawyers in an effort to find the source of media leaks. One of the recipients of the tracking device, which was described as malware, is an Air Force defense attorney involved in the case.

“In fact, I’ve learned that the Air Force is treating this malware as a cyber-intrusion on their network and have seized the Air Force Individual Military Counsel’s computer and phone for review,” Wilson wrote.

In addition to the Air Force’s email network, the tracking software also infiltrated the Navy-Marine Corps Intranet email network and private networks, according to the May 19 memo.

The Office of Federal Procurement Policy within the Office of Management and Budget submitted six legislative proposals to Congress in April as part of its acquisition reform efforts, Federal News Network reported Monday.

One of those proposals is the establishment of an acquisition modernization test board, which would update OFPP’s authority with regard to governmentwide procurement testing and create “test programs that promote incremental improvement of acquisition practices.”

“We believe the best way to accomplish the goals [of the President’s Management Agenda] is to accelerate the pace of transformation through smart piloting where we learn a little, through testing and getting back from all of you, making adjustments based on what we learn and do additional testing,” Matt Blum, associate administrator at OFPP, said at the Coalition for Government Procurement’s spring conference in Falls Church, Va.

“Testing allows us to constantly change and challenge ourselves to do better, to disrupt the environment in a manageable way. But also equally important, it helps us to manage risk, especially in initiatives that have multiple dimensions,” he added.

The board would also help the OFPP administrator decide on waivers of procurement laws as part of a pilot initiative in order to find ways how to improve the efficiency of the acquisition process, according to the report.

The Department of Homeland Security is collaborating with industrial control system vendors to test products to secure critical facilities such as power plants against cyber attacks, Cyberscoop reported Monday.

Jeanette Manfra, assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency, said at the Hack the Capitol conference in Washington, D.C. that the DHS aims to “have much more capability” to detect and mitigate attacks to ICS infrastructure and evaluate ICS products before they enter the market.

“We want the ICS community – and those are both the vendors and the operators of the system – to be able to be more empowered to defend themselves,” she said. According to Dragos, a Hanover, Md.-based ICS security company, one-third of the ICS security vulnerabilities identified by DHS in 2018 had errors on the scoring system for potential severity.