New OMB IT policy memo rings familiar, but signals major shifts

Terry Gerton There was an interesting memo from OMB that came out on March 31, reinforcing transparency, accountability, and oversight of federal technology, or in the vernacular M-26-10. Let’s start with the high-level view of this. Why did they feel like they needed to issue this memo?

Emily Murphy There are two parts of the memo, and I think there might be different reasons for each part. When I read it, the first part seems to be really reinforcing FITARA — that we want the CIOs to be in charge of IT spending, we want them to have insight into it, we want governmentwide insight into it. But it does seem to replicate the data that should be in the IT dashboard already, so it suggests that maybe there’s something that’s missing from that IT dashboard. And then the second part is a lot more data on the contracting and how we’re getting to the contracts and utilization and transactional data of all sorts. The second was really a fascinating part to that memo.

Terry Gerton Well, let’s dig into those pieces separately and take the first one. What’s going on with the data around IT spend? Why would they need to collect it again or separately?

Emily Murphy Well, it’s asking for two types of data. First of all, the contracts, any dollar value, anything else that a CIO of a CFO Act agency other than the Department of War has signed off on personally. Now, under FITARA, they’re supposed to be signing off on all of them, so it’s an interesting question. And then also for data on anything that they’ve delegated to someone else within the agency if it’s touching the public. So if there is a question of all right, do we feel that there’s stuff that’s slipping through the cracks? And that’s what it seems to be suggesting, is that there is something or some data that OMB wants to be tracking, and it’s an attempt to really empower the CIOs to get their hands around that spending and collect data. But one question I had is how they’re going to collect all this data and what are they going to do with it? Because it could be a lot of data.

Terry Gerton It sounds like a pretty burdensome request, and OMB and GSA have been about lifting some burden. Does this conflict with their general approach?

Emily Murphy Well, it’s a request that only is in place for about six months. So they’re saying we want the rest of the fiscal year, we want to collect this data, unless we extend the memo further. And they do leave open that possibility. But it does suggest that there are contracts that were slipping through and that they want the data to make sure that they’re catching those, that they are catching probably enterprise data, which is what we’re seeing in the second part of the memo. But also then, maybe, are they looking for a better approach to that IT dashboard? Are they finding that there’s something missing there or that there is something cluttering their decision-making there? The fact that they’re focusing on public-facing systems also, or public-touching systems, I think that’s particularly interesting because that suggests that return to a focus which we saw in the first Trump administration on the customer experience part of things as well and providing service to citizens. So it could be signaling some really interesting things, but it’s unclear from how they’re collecting the data, what they’re going to do with that part of it.

Terry Gerton Emily, when you think about this new guidance, at least in this data-collection part, side by side with what agencies are supposed to do — and you’ve said there’s the IT dashboard, there’s FITARA, the CIOs are supposed to be collecting this. What will they have to do differently to be in compliance with this memo?

Emily Murphy They’re going to have to have a whole new data process, because it’s no longer going to be the automated process that they’ve had since the dashboard was launched in 2009. So now we’re going to have a manual submission to OMB of this data, which means that every IT contract, they’re going have to a way of pulling that data and then sending it over to OMB.

Terry Gerton I’m speaking with Emily Murphy. She’s senior fellow at the George Mason University Baroni Center for Government Contracting and former GSA administrator. Well, let’s take part two, the part that you found fascinating. What’s so fascinating there?

Emily Murphy I did. Well, so part two goes — you know, my heart’s in contracting. So it was the contracting data that they’re asking for. So when you look at part two of the memo, they start to say that we want transactional-level, they say utilization data and pricing data, on all IT purchases — software, hardware, services. And we want them no matter how you’re buying them. It doesn’t matter if we’re buying it directly from the OEM, if you’re buying it from a reseller or wholesaler, integrator, we don’t care. We want all this data. And we want you to change actually even how you’re putting your contracts out there to say that the data has to be collected. And it has to given — you’ve got to put a clause in your contract saying that it has be shared with OMB and GSA, no matter who the contracting agency is. So last year, when GSA was doing a lot of “defend the spend,” some contractors pushed back and said, wait a second, GSA, we don’t have a privity of contract with you. We can’t give you this data without the contracting agency giving us permission. This is going to say, nope, GSA can reach in, OMB can reach in and grab that data. GSA’s made the move towards transactional data across all the schedules. So it was already collecting much of this data. Now we’re going to see it applying to all the contracts out there on IT. So it really seems to be an attempt to figure out how much we’re paying for things, how much were using them. In some ways, it’s getting ahead of the SAMOSA Act that Congress has been considering on software licenses. It also seems to trying to look at it and say, all right, you’ve got GSA running their OneGov deals. You’re seeing Army came out with its enterprise licensing deals. Other agencies are starting to talk about doing this. It seems to be a way that they’re going to go in and try and dig in and see which deals are really good deals — and how do we leverage those?

Terry Gerton Emily, it seems like they could get overwhelmed with the tsunami of data. Do they have the collection mechanisms and systems to get all of this together and make sense of it?

Emily Murphy Well, so they specify the collection of data that the data has to be submitted in a machine-readable format, which I think suggests they’re going to use this as a test of the AI tools they’ve got and see what they can scrape from the data that way, and really try and figure out the range of prices they’re paying, but also if they’ve licenses they’re not using, how do they re-scope their contracts? This could also signal a return to those defend-the-spend discussions of last year — and a return to the memos we saw going out from GSA last fall on reseller markups. This could be giving us a lot more data so you see the variability in pricing depending on how things are bought.

Terry Gerton Well, if you’re then an agency CIO or a contracting officer, what do you need to do to be responsive to this? How quickly do you to respond to this?

Emily Murphy They’ve got pretty tight timeframes around all of these. So they’re saying that top-level CIO-covered agencies, they have to be submitting their data on what they’ve signed off on within 30 days. And then when it comes to eliminating the second part of it, the timeframe on it is also a pretty tight turnaround. So I think it also is a 30-day turnaround on their data. It’s not as explicit, but it seems to be, since they’re putting it into contracts, they’re looking at this as an ongoing data requirement. This isn’t the testing of data that they’re doing in part one. Part two is an ongoing way where we’re going to evaluate contract data. And TDR data is usually is done on a monthly basis. So this could be an ongoing scarping of data.

Terry Gerton  Any concern about the workforce that’s available to take on this extra reporting requirement? CIO shops were downsized, contracting offices were downsized over the last year.

Emily Murphy And that’s where it’s going to become particularly interesting. The first part of it, it’s what has the CIO touched, what has the CIO’s delegee touched, and getting that information in. So that’s going be a little less simple to automate. Whereas instead, with the second part on eliminating information silos and technology contracts, that’s going to become — it’s really going to be a TDR mechanism. And so they’re going to have to have a portal to submit it. I assume it’ll be very similar to the portal GSA’s already created. And then you’re going have the challenge for contracting officers of inserting the new clause into the contracts. But that’s a fairly standard thing for contracting officers to be doing. It’s just, it is one more thing that they’re willing to be doing as we’re entering the third quarter of the fiscal year. So just as things usually are starting to speed up in federal contracting, we’re going to do a little bit more analysis and a little more digging around in that data. It could be a really useful data set at the end of the day, assuming that the right parameters are applied to it.

Terry Gerton Well, it will take them a few months, I suppose, to get enough data to start to look at and draw some conclusions. What sort of timeline would you be expecting for OMB and GSA to then say, OK, we’ve been looking at this data. We’ve been collecting it. Now here’s some new guidance.

Emily Murphy I would expect that you’re going to see on the first part of it that we will see something by the end of the fiscal year. We’ll either see an extension of this or we’ll see new guidance on the role of CIOs in IT purchases and IT systems. On the second part though, I think that it’ll only take them a few months to start saying, all right, here’s what we’ve determined is within the range; if anyone’s got data that’s outside of that range, speak up now. And I think you’re going to see that start to inform contracting strategy. I would suspect that it could also feed into — in that Revolutionary FAR Overhaul, in part 8, there was a 8.104A suggested that there could become, that OFPP could designate certain contracts as required use contracts. This could be a way of identifying which contracts or what range of contracts fall into that required use space as well, which ones are really the best deals. And I think it’s going to give us some actually very interesting data on the difference between OEM and reseller pricing and whether or not resellers actually cost more than OEMs at the end of the day.

Terry Gerton And so if you’re a vendor in this space, what should you be watching out for?

Emily Murphy I’d be watching out for the change to my contract, the request for the data overall, and I’d have a lot of questions about as the vendor, how am I supposed to provide utilization data? In some cases, I may have that. In other cases, I may not have that. I may not have that insight into how federal agencies are using their licenses.

Terry Gerton There’s certainly going to be a lot to watch here as it rolls out.

Emily Murphy There is indeed. It was a really surprising memo to see and it’s going to be very interesting to see how it’s leveraged going forward.