Free Response to Motion - District Court of Federal Claims - federal

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 1 of 38

Exhibit 24

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 2 of 38

Status Report to the Court Number Twenty-Eight
For the Period October 1, 2006 through December 31, 2006

February 1, 2007

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 3 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~ 1, 2007
I

Table of Contents

TABLE OF CONTENTS INTRODUCTION ......................................................................................................................... I. II. OFFICE OF HISTORICAL TRUST ACCOUNTING ................................................. OFFICE OF THE SPECIAL TRUSTEE FOR AMERICAN INDIANS ..................... 1 3 9 11 15 19 19 21 25 27 29 31 33 37 37 39 39 41 43 43 51 55 57

A. TRUST SERVICES - CURRENT ACCOUNTING .................................................... B. C. 1. 2. 3. 4. 5. OFFICE OF TRUST RECORDS .................................................................................. TRUST ACCOUNTABILITY ....................................................................................... TRUST BUSINESS PROCESS MODELING .......................................................... TRUST DATA QUALITY AND INTEGRITY ........................................................ INDIAN FIDUCIARY TRUST TRAINING PROGRAM ...................................... RISK MANAGEMENT .............................................................................................. TRUST REGULATIONS, POLICIES AND PROCEDURES ...............................

D. TRUST REVIEW AND AUDIT .................................................................................... E. III. OFFICE OF APPRAISAL SERVICES ........................................................................ INDIAN AFFAIRS ..........................................................................................................

A. TRUST REGULATIONS, POLICIES AND PROCEDURES ................................... IV. BUREAU OF INDIAN AFFAIRS .................................................................................

A. FRACTIONATION ..... i ................................................................................................... B. PROBATE ........................................................................................................................

V. OTHER TOPICS ................................................................................................................ A. INFORMATION TECHNOLOGY ............................................................................... B. C. CADASTRAL SURVEY ................................................................................................ MINERALS MANAGEMENT SERVICE ...................................................................

ACRONYMS AND ABBREVIATIONS ...................................................................................

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 4 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~l, 2007 B. OFFICE OF TRUST RECORDS Introduction The Office of Trust Records was established in 1999 to develop and implement a program for the economical and efficient management of trust records, consistent with the 1994 Act, the Federal Records Act and other statutes and implementing regulations. The OTR records management program has been developed and implemented, and continues to evolve, to ensure that necessary Indian records are maintained, records retention schedules are consistent with retention needs, and records are safeguarded throughout their life-cycles. Accomplishments and Completions American Indian Records Repository The American Indian Records Repository was built by Interior in collaboration with NARA for the purpose of consolidating and preserving Indian records at one NARA regional records center. The facility, located in Lenexa, Kansas, opened in May 2004. Prior to the opening of AIRR, Indian records were stored in various NARA regional records centers, BIA, and other government facilities across the United States. All Indian records from the NARA centers have been shipped to AIRR, while records continue to be collected from the other locations for shipment to AIRR. Indian records are indexed at the AIRR Annex before being transferred to AIRR for storage. A file level index of the contents of each box is stored in an electronic data base called the Box Index Search System. Approximately 4,030 boxes of inactive records were moved from BIA/OST field locations to the Lenexa Annex for indexing during this reporting period. Indexing of approximately 151,675 boxes has been completed as of the end of this reporting period. Approximately 150,745 indexed boxes have been sent to AIRR for permanent storage. Training OTR provided records management training for 107 BIA and OST records contacts and 51 tribal employees during this reporting period. OTR provided records management training to Tribes as they requested training. Current Status Safeguarding Records As previously reported, since June 2005, NARA has completed remediation of all but six of the previously-reported 283 boxes of inactive records that were damaged or contaminated by mold, mildew, mouse droppings or other adverse elements. Office of Trust Records

15

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 5 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~l, 2007 Office of Trust Records

The materials NARA could not repair consisted of one box that has about 25% of its contents covered with a tar-like substance; one entire box that had mold and the files are stuck together; and one box of green bar printouts from 1989 oil and gas royalty disbursements that have holes in the printout caused by insects. Three boxes have extensive water damage and the contents are stuck together. Although NARA recommended that the documents should not be separated, an independent conservator indicated that it would be possible to salvage some of the information through physical stabilization or recovery of the information through reproduction techniques. In November 2006, OTR's conservation contractor conducted an in depth review of the box contents and drafted a remediation plan. OTR has determined that there are two boxes that may contain trust records and should undergo repair/conservation. The other boxes do not contain trust records and will be stored at the AIRR without remediation treatment. Based on the contractor's estimate, the remediation and conservation work, which will be labor intensive, is expected to be completed by the end of February 2007. Also, as previously reported, NARA recommended copying for preservation purposes of maps from eight oversized boxes. However, several of the large maps are too big for NARA's copiers. Remediation of these maps by the contractor is expected to be completed by February 2007. OTR will review the maps once they have been treated and make a determination whether the maps should be copied using other methods. Records Retention Schedules Records retention schedules for the following BIA electronic records systems were completed in the previous reporting period and were forwarded to NARA in November 2006: National Irrigation Information Management System, PC Lease, San Carlos Irrigation Project, Document Management Program, and Integrated Transportation Information Management System. The BIA Geographic Information System records retention schedule continues to await approval by the Archivist of the United States. Records retention schedules for the following BIA electronic records systems were developed and forwarded to NARA during the last week of December 2006: Social Services Assistance System, Progeny, Facilities Management Information System, Fee-to-Trust, Identity Information System, National Integrated Oil and Gas Electronic Management System, Timber Sales Accounting and Report Program/Operations Inventory and Colorado River Electrical Utility Management System. Records retention schedules for the following OST electronic records systems were developed and forwarded to NARA during the last week of December 2006: Risk Management Plus, Trust Beneficiary Call Center, and Lockbox/Trust Funds Receivable Application. Paper records retention schedules for the following OST offices were completed during the previous reporting period and were circulated for review by OST managers during this reporting period: Office of the Principal Deputy Special Trustee; Office of External Affairs; Office of the Chief Information Officer; Office of Budget, Finance and Administration; Office of the Deputy

16

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 6 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~ 1, 2007 Office of Trust Records

Special Trustee, Trust Accountability; Office of the Deputy Special Trustee, Field Operations; and Office of the Deputy Special Trustee, Trust Services. It now is anticipated that the schedules will be forwarded to NARA in the next reporting period. Delays and Obstacles Lack of Internet access continues to hinder OTR's ability to provide remote access to the record index database for authorized users of the records. If Internet access were available, authorized researchers could conduct their searches from their respective work sites and only visit AIRR when necessary to inspect specific boxes or request documents from specific boxes. Assurance Statement I concur with the content of the information, contained in the Office of Trust Records section of the Status Report to the Court Number Twenty-Eight. The information provided in this section is accurate to the best of my knowledge. Date: January 12, 2007 Name: Signature on File Ethel J. Abeita Director, Office of Trust Records Office of the Special Trustee for American Indians

17

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 7 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~ 1, 2007 3. Introduction Interior has a continuing responsibility to provide adequate staffing, supervision and training for trust fund management and accounting activities. Fiduciary trust training is essential to the success of Interior's trust reform efforts and forms an integral part of all training for Interior employees who are involved in the management of Indian trust assets. Accomplishments and Completions The Cannon Financial Institute presented two Certification Review & Tests courses for the Certified Indian Fiduciary Trust Specialist certification program to 29 OST, two BIA and one tribal personnel. All 32 passed the exams and were awarded their certifications. Current Status During this reporting period, Cannon Financial Institute personnel presented: One Indian Fiduciary Trust Principles course to 23 OST, BIA and tribal personnel. Completion of this course, passing an exam and reviewing a DVD entitled Fiduciary Concepts are requirements of the Certified Indian Fiduciary Trust Analyst certification. Eight specialty courses to 133 OST, BIA and tribal personnel. The specialty courses, Risk Management, Probate, Trust Accounting, Asset Management, Fiduciary Behavior and Guardianships are part of the Certified Indian Fiduciary Trust Specialist certification program. During this reporting period, OST training staff conducted four training sessions for 69 OST, BIA, and contractor staff on the use of TFAS and related systems and reporting programs that include: ¯ ¯ CSS - used to enter, approve and post cash transactions; Stratavision - contains daily, weekly and monthly reports from OST systems for viewing by OST and BIA staff; Historical Query Database - contains account transaction history going back to 1985; and TFR - Trust Funds Receivable - used for tracking lockbox receipts. Indian Fiduciar~¢ Trust Trainin~ Program INDIAN FIDUCIARY TRUST TRAINING PROGRAM

¯

¯

OST and BIA staffpresented three Trust Fundamentals courses to 70 OST, BIA, MMS, BLM, USGS, and tribal staf£ This course includes such topics as the history and policy of Indian trust,

25

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 8 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT February 1, 2007 Ind!an Fiduciary Trust Trainin~ Program

current trust reform activities, job roles and responsibilities, and organization and working relationships. Delays and Obstacles The lack of Internet access inhibits electronic communication with other governmental agencies and contractors, hinders the research of training tools and potential contractors, and restricts OST's ability to access online training programs. Assurance Statement I concur with the content of the information contained in the Indian Fiduciary Trust Training Program section of the Status Report to the Court Number Twenty-Eight. The information provided in this section is accurate to the best of my knowledge. Date: January 11, 1007 Name: Signature on File Dianne M. Moran Director, Office of Trust Training Office of the Special Trustee for American Indians

26

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 9 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT February 1, 2007 V. OTHERTOPICS A. INFORMATION TECHNOLOGY Introduction This section describes the status of Interior IT systems, particularly the systems that house or provide access to IITD or provide various computing capabilities, including functions critical to the proper administration of the individual Indian trust responsibilities within Interior. In addition, this section describes various efforts being made to improve IITD security within Interior, pursuant to OMB Circular A-130 Appendix III, and challenges due to no Internet connectivity at four bureaus. Accomplishments and Completions Computer Security: Interior continues to make progress in enhancing IT security through improvements to the vulnerability scanning process and the re-Certification & Accreditation of systems. The most noteworthy accomplishments, completions and challenges during the reporting period are described below. Prevention and Monitoring ¯ An ESN contractor selected a new product to continue the on-going external vulnerability scanning service for Interior. Interior took the opportunity at this time to make the service available to bureaus for their internal vulnerability scanning solution. Policies and Guidance ¯ The Interior CIO issued "Fiscal Year (FY) 2006 Assurance Statement for Information Technology (IT) Security" to the Assistant Secretary for Policy, Management and Budget on October 13, 2006. This report presented the summary assessment of the adequacy of bureau, office, and departmental (common) controls related to information systems and information technology programs. The CIO noted many "significant" accomplishments, including increased security through centralizing Internet gateways at ESN and enhancements in IT security training. The Interior CIO issued "Additional Guidance for the Protection of Personally Identifiable Information (PII) and Department Sensitive Information" to the heads of bureaus and offices and to bureau and office Chief Information Officers on December 15, 2006. This memorandum directed the bureaus to implement encryption for mobile devices (e.g., laptops and remote workstations/servers) as an interim solution until an Interior-wide encryption product can be procured. The Interior CIO issued "Internal Control Review (ICR) Guidance for Fiscal Year (FY) 2007" to the heads of bureaus and offices and to bureau and office Chief Information Officers on December 20, 2006. This directive provides specific guidance for IT system 43 Information Technolo~y

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 10 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~ 1, 2007 Information Technolo~

owners and Bureau Information Technology Security Manager (BITSMs) for conducting annual assessments of the security controls in place for all IT systems contained in DEAR. The Interior CIO issued "Trust Asset and Accounting Management System (TAAMS)" to the Deputy Director, Office of Trust Services on December 27, 2006. This memorandum informed the Deputy Director that the TAAMS project would be subject to a project management review performed by OCIO. BLM issued two policies during this reporting period that provided system owners and project managers with the upcoming schedule for system C&A, and reminded all system owners of the requirement to apply funding towards sustaining and maintaining security certifications. Training and Awareness ¯ BLM hosted an OST "Trust Fundamentals" class at its New Mexico State Office as part of its plan to elevate awareness of trust responsibilities and accountability. Plan of Action and Milestones4: ¯ As reported to OMB, Interior has continued to remediate and close out a significant number of weaknesses, eliminating 266 during this reporting period. However, 444 new weaknesses were identified and added; many resulted from self-assessments, independent financial audits and findings based on OIG reports. Interior continues to proactively address the remaining 1,880 open weaknesses. IT Systems Architecture: ¯ Interior revised the draft Trust Modernization Blueprint to include a more detailed analysis of the data managed by current information systems and how well those systems support the streamlined business processes in the Fiduciary Trust Model. The MMS EA Team completed the alignment of five major systems (four MAs and one GSS) with the five DOI/OMB reference models (Business, Performance, Data, Services and Technical).

4 A Plan of Action and Milestones (POA&M), also referred to as a corrective action plan, is a management tool that outlines identified IT security program and system weaknesses, along with the tasks necessary to correct or mitigate them. To facilitate the remediation of weaknesses, the POA&M process provides a means of planning and monitoring corrective actions; identifies those responsible for solving problems; assists in identifying security funding requirements; tracks and prioritizes resources; and informs senior management of the security status of programs and systems.

44

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 11 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~ 1, 2007 Information Technolo~)z

E-Authentication5 and HSPD-126: The HSPD-12 contract was awarded during this reporting period. Upon awarding the contract, NBC began issuance of smart cards before an OMB-mandated deadline. Staffing: The following positions were filled during this reporting period: o Interior's Security Program Manager, Security POA&M Lead and ZANTAZ Liaison, o NBC's CIO, o BLM's Deputy CIO, and o MMS's IT Security Manager. Current Status A-130 Certification and Accreditation: Of the 36 trust systems that are currently tracked in DEAR, all have full ATO status except the FWS Isolated Realty Network. The ST&E results and documentation for IRN are currently being reviewed. The system is expected to be fully accredited during the next reporting period. BIA completed the Trust Active Directory root services C&A package in August 2006. This system provides authentication services for TrustNet, which is the network supporting the disconnected bureaus. A meeting held in December 2006 resolved a majority of the issues without the need to develop an MOU. The remaining issues involve deployment of the system across the trust bureaus. Full accreditation is expected upon resolution of these issues. ¯ The re-C&A of MMSNet is in the ST&E phase and an MMS contractor completed testing of the system. MMS is awaiting results of the testing.

ZANTAZ7: ¯ The 25 BLM tapes that were shipped to ZANTAZ, as reported in the previous report, have been received. ZANTAZ informed Interior that they will process the tapes by the end of the next reporting period. 5 E-Authentication is designed to provide a trusted and secure standards-based authentication architecture. This approach would provide a uniform process for establishing electronic identity and eliminate the need to develop redundant solutions for the verification of identity and electronic signatures. E-Authentication's distributed architecture would also allow citizens and businesses to use non-government-issued credentials to conduct transactions with the government. 6 HSPD-12 would establish a common identification standard for all federal government employees and contractors for physical and computerized systems and data access while providing a roadmap for other applications. The HSPD-12 policy establishes sound criteria for verifying an employee's identity designed to be strongly resistant to identity fraud, tampering, counterfeiting and terrorist exploitation. The standard includes graduated criteria, from least secure to most secure, to ensure flexibility in selecting the appropriate level of security for each application. 7 ZANTAZ is a contractor that archives emails sent to and from certain bureaus and offices.

45

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 12 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT ,Februar~ 1, 2007 Information Technolo~

The contract was awarded in December 2006 for the forensic analysis of the 268 blank BIA tapes documented in the Status Report to the Court Number Twenty-Five. The analysis is expected to be completed in the next reporting period. The testing of the software to correct the NBC/BLM ZStage8 irregularity reported in the Status Report to the Court Number Twenty-Six has been completed. BLM and ZANTAZ have determined that the upgrade will not correct the irregularity and they continue to work on identifying an alternative solution. SOL experienced a ZANTAZ outage from November 18-22, 2006. The outage was the result ofa mis-onfiguration ofa ZANTAZ device. No emails were lost since the SOL buffer server captured and re-transmitted all emails that were awaiting transmission to ZANTAZ. Training and Awareness: ¯ A large number of NBC and MMS systems are due for re-C&A this fiscal year. Therefore, NBC and MMS are providing focused C&A training to management and staff. Incidents: On December 28, 2006, four tribal computers, four tribal flash drives and an unknown number of tribal CDs were stolen from a 6389 tribal office located on Yakama Nation property. This incident was reported to local police and remains under investigation. An OCIO task force continues to evaluate the types and sensitivity of the data involved and determine appropriate response actions. ¯ OHA reported potential misuse ofa laptop computer in December 2006. The incident remains under investigation.

Reports: These reports were among those issued during this reporting period. ¯ The Interior IG issued "Vulnerability Assessment Report of MMS Third Party Service Provider USinternetworking (USi) (NSM-EV-MMS-0009-2006)'" on September 27, 2006. This report presents the results of an evaluation of a contractor system involved in hosting MRM data. In this report, the OIG indicates that the site is "reasonably secure, with security countermeasures commensurate with the data it is hosting."

ZStage refers to a mechanism that verifies delivery of emails to the ZANTAZ digital safe. Each message is assigned a value indicating success or failure of delivery. 9 A "638 Tribe" provides services to tribal members under the Indian Self-Determination and Education Assistance Act, Public Law 93-638 (as amended). This act authorizes Tribes to contract and compact with the federal government to perform certain federal programs. 46

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 13 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~ 1, 2007 Information Technolo~

The Interior IG issued "FY2006 FISMA Report (NSM-EV-OIG-0002-2006)'" on September 29, 2006. This report presents the results of the IG's annual evaluation of Interior's IT security program, as required by FISMA. It noted many "significant'" accomplishments, including increased security through centralizing Intemet gateways at ESN and enhancements in IT security training. However, the IG found that challenges still remain in the quality of C&A practices and the implementation of security configuration standards. The GAO issued "Agencies Need to Develop and Implement Adequate Policies for Periodic Testing (GAO-07-65)" on October 20, 2006. This report presented the results of a survey of 24 major federal agencies and their Inspectors General, as well as analysis of their information security policies and procedures. The GAO determined that agencies have not adequately designed or effectively implemented policies for performing periodic testing and evaluation of information security controls. Delays and Obstacles Like other federal agencies, Interior must address many challenges regarding the integration, performance, funding, security, and data integrity of IT systems. Interior initiated or completed steps to address some of the challenges reported in this and previous reporting periods. However, delays and obstacles listed below impede progress in achieving Interior's IT management goals. Staffing ¯ Interior is experiencing high staff and management turnover in critical IT positions, particularly IT security. Recruitment challenges to attract qualified candidates continue, particularly in light of past litigation impacts. During this reporting period, the Interior CIO announced his retirement from federal service and that his last official day would be January 3, 2007. The Interior Deputy Secretary named the CIO for the Fish and Wildlife Service as the acting Interior CIO effective on January 4, 2007. The following positions remain vacant at the end of this reporting period: o Interior's Deputy CISO and Security Policy Lead, o NBC's Deputy CIO and IT Security Manager, o MMS's MRM IT Security Manager, o BLM's IT Security Manager, and o BIA's CIO and C&A Project Manager. Funding and Resources ¯ Interior continues to operate under a continuing resolution, impacting the ability of Interior to fill personnel vacancies, complete projects and meet deadlines.

47

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 14 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~ 1, 2007 Denied Internet Access Four Interior bureaus and offices (BIA, OHA, OST and SOL) have not been permitted by the Court to have Internet access since December 5, 2001. Lack of Internet access impedes work processes and the ability to communicate effectively, both internally and externally. For example: Currently the BIA Transportation Division utilizes an application system titled the Integrated Transportation Information Management System to manage and report on the maintenance of roads, bridges and the core transportation infrastructure within Indian country. ITIMS does not contain any ItTD. However, being offline significantly inhibits BIA's ability to interface with the Tribes, share information and effectively manage millions of dollars in BIA and Federal Highway funds. The BIA Transportation Office would like to implement a replicated version of ITIMS, which would be totally isolated from TrustNet, but be accessible via the Tribes through a direct connection to the Internet. Data would be synchronized between the two networks using physical/removable media. This synchronization and replication would not be necessary but for the Court order. On October 16, 2006, the Trust Executive Steering Committee authorized a pilot project to permit additional Tribes to access TrnstNet in compliance with federal security requirements. The Morongo Band of Mission Indians is the first Tribe that Interior is working with under this pilot project. Under a Memorandum of Understanding and Tribal Use Agreement, tribal employees would have access to an Interior computer and would be treated similarly to federal employees and contractors with access to TrnstNet. All appropriate IT security directives will be extended to the Tribe and its users. The Morongo Band has agreed to the terms of the Memorandum of Understanding and Tribal Use Agreement as well as unannounced IT security visits, and made all the recommended changes to support physical security requirements requested. Without the Court order, trust connectivity, such as that sought here, would be less complex, less costly, and could be accomplished more quickly. ¯ Maintaining security on internal systems is more difficult without access to the Internet for research, reporting, and patch management. Policy discussion is hampered due to additional time required in coordinating group discussions via teleconferencing when e-mail collaboration would be more appropriate and timely. OMB's e-Government initiative requires agencies to web-enable as many of their applications as possible. Without internet access, Interior cannot comply with this and other OMB initiatives, like consolidation of agencies' network infrastructures. ,, Information Technolo~

48

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 15 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT Februar~ 1, 2007 Information Technolo~

The concerns over potential future Court-ordered Internet shutdowns or other Courtordered disruptions has created uncertainty over how to proceed with enterprise initiatives and security improvements. Without connectivity between the disconnected and online bureaus and offices, implementation of true enterprise-wide applications has been difficult. Plans and funding call for only a single instance of an application to service all bureaus and offices. Many of these applications rely upon the internet to service external as well as internal customers. Providing access to the disconnected bureaus and offices would eliminate duplicate systems, networks, and data. Duplicate systems require a significant increase in resources to manually transfer data between the two systems. The possibility of future disruptions also raised concern about Interior's ability to provide services to its non-Interior customers. Coordination and dissemination of new policies and training is delayed due to the need to deliver material physically. Even after receipt, considerable re-work is required to tailor web-based training programs to run locally. Courses normally are completed on-line through DOI LEARN, but also must be duplicated in stand-alone CD-ROM and paper forms for the off-line bureaus. Ensuring continuity of operations and continuity of government through the implementation of contingency plans requires rapid notification of an event. The lack of Internet access degrades Interior's capabilities to notify all of its bureaus and offices in a timely and efficient manner. Additionally, without remote access, disconnected bureaus and offices will be unable to provide services to their customers in the event of extended contingency periods that may result from pandemics or major natural events. Assurance Statement I concur with the content of the information contained in the Information Technology section of the Status Report to the Court Number Twenty-Eight. The information provided in this section is accurate to the best of my knowledge. Date: January 25, 2007 Name: Signature on File Michael J. Howell, Jr. Interior Acting Chief Information Officer

49

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 16 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-EIGHT February 1, 2007 Information Technology

THIS PAGE INTENTIONALL Y BLANK

5O

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 17 of 38

Exhibit 25

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 18 of 38

Status Report to the Court Number Twenty-Nine
For the Period January 1, 2007 through March 31, 2007

May 1, 2007
II

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 19 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE May 1, 2007 , TABLE OF CONTENTS INTRODUCTION ......................................................................................................................... I. II. OFFICE OF HISTORICAL TRUST ACCOUNTING ................................................. OFFICE OF THE SPECIAL TRUSTEE FOR AMERICAN INDIANS ..................... 1 3 9 11 15 t9 19 21 23 Table of Contents

A. TRUST SERVICES - CURRENT ACCOUNTING .................................................... B. C. 1. 2. 3. 4. 5. OFFICE OF TRUST RECORDS .................................................................................. TRUST ACCOUNTABILITY ....................................................................................... TRUST BUSINESS PROCESS MODELING .......................................................... TRUST DATA QUALITY AND INTEGRITY ........................................................ INDIAN FIDUCIARY TRUST TRAINING PROGRAM ......................................

RISK MANAGEMENT .............................................................................................. 25 TRUST REGULATIONS, POLICIES AND PROCEDURES ............................... 27 29 31 35 35 37 37 39 41 41

D. TRUST REVIEW AND AUDIT .................................................................................... E. OFFICE OF APPRAISAL SERVICES ........................................................................ III. INDIAN AFFAIRS ..........................................................................................................

A. TRUST REGULATIONS, POLICIES AND PROCEDURES ................................... IV. BUREAU OF INDIAN AFFAIRS .................................................................................

A. FRACTIONATION ........................................................................................................ B. V. PROBATE ....................................................................................................................... OTHER TOPICS ............................................................................................................ A. INFORMATION TECHNOLOGY ............................................................................... B.

CADASTRAL SURVEY ................................................................................................ 47 51 53

C. MINERALS MANAGEMENT SERVICE ................................................................... ACRONYMS AND ABBREVIATIONS ...................................................................................

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 20 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE Indian Fiduciar~ Trust Trainin~ Program 3. Introduction Interior has a continuing responsibility to provide adequate staffing, supervision and training for trust fund management and accounting activities. Fiduciary trust training is essential to the success of Interior's trust reform efforts and forms an integral part of all training for Interior employees who are involved in the management of Indian trust assets. Current Status During this reporting period, Cannon Financial Institute personnel presented: One Indian Fiduciary Trust Principles course to 22 OST, BIA and tribal personnel. Completion of this course, passing an exam and reviewing a DVD entitled Fiduciary Concepts are requirements of the Certified Indian Fiduciary Trust Analyst certification. Five specialty courses to 70 OST and BIA personnel. The specialty courses, Risk Management, Probate, Trust Accounting, Asset Management, and Fiduciary Behavior and Guardianships are part of the Certified Indian Fidueiary Trust Specialist certification program. During this reporting period, OST training staff conducted 10 training sessions for 114 OST, BIA, and contractor staff on the use of TFAS and related systems and reporting programs that include: ¯ ¯ CSS - used to enter, approve and post cash transactions; Stratavision - contains daily, weekly and monthly reports from OST systems for viewing by OST and BIA staff; Historical Query Database - contains account transaction history going back to 1985; and TFR - Trust Funds Receivable - used for tracking lockbox receipts. INDIAN FIDUCIARY TRUST TRAINING PROGRAM

¯ ¯

OST and BIA staff presented one Trust Fundamentals course to 16 OST and DOI University staff. This course includes such topics as the history and policy of Indian trust, current trust reform activities, job roles and responsibilities, and organization and working relationships. Delays and Obstacles The lack of Internet access inhibits electronic communication with other governmental agencies and contractors, hinders the research of training tools and potential contractors, and restricts OST's ability to access online training programs.

23

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 21 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE Ma~ 1, 2007 Indian Fiduciary Trust Trainin~ Program

Assurance Statement I concur with the content of the information contained in the Indian Fiduciary Trust Training Program section of the Status Report to the Court Number Twenty-Nine. The information provided in this section is accurate to the best of my knowledge. Date: April 23, 2007 Name: Signature on File Dianne M. Moran Director, Office of Trust Training Office of the Special Trustee for American Indians

24

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 22 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE Ma~l, 2007 B. OFFICE OF TRUST RECORDS Introduction The Office of Trust Records was established in 1999 to develop and implement a program for the economical and efficient management of trust records, consistent with the 1994 Act, the Federal Records Act and other statutes and implementing regulations. The OTR records management program has been developed and implemented, and continues to evolve, to ensure that necessary Indian records are maintained, records retention schedules are consistent with retention needs, and records are safeguarded throughout their life-cycles. Accomplishments American Indian Records Repository The American Indian Records Repository was built by Interior in collaboration with NARA for the purpose of consolidating and preserving Indian records at one NARA regional records center. The facility, located in Lenexa, Kansas, opened in May 2004. Prior to the opening of AIRR, Indian records were stored in various NARA regional records centers, BIA, and other government facilities across the United States. All Indian records from the NARA regional centers have been shipped to AIRR, while records continue to be collected from the other locations for shipment to AIRR. Indian records are indexed at the AIRR Annex before being transferred to AIRR for storage. A file level index of the contents of each box is stored in an electronic data base called the Box Index Search System. Approximately 5,223 boxes of inactive records were moved from BIA/OST field locations to the Lenexa Annex for indexing during this reporting period. Indexing of approximately 154,420 boxes has been completed as of the end of this reporting period. Approximately 151,600 indexed boxes have been sent to AIRR for permanent storage. Training OTR provided records management training for 198 BIA and OST records contacts and 52 tribal employees during this reporting period. OTR provided records management training to Tribes as they requested training. Current Status Safeguarding Records As previously reported, in November 2006, OTR's conservation contractor conducted an in depth review of box contents and drafted a remediation plan. OTR had determined that two boxes contained trust records and would undergo repair/conservation. The other boxes did not contain trust records and were to be stored at the AIRR without remediation. However, it was subsequently decided by OTR that the contents of all six boxes would undergo Office of Trust Records

15

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 23 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE Marc 1, 2007 Office of Trust Records

repair/conservation, which was completed in this reporting period. The conservator separated pages, flattened, cleaned and repaired documents as necessary. Parallel files were set up as necessary (parallel files are composed of copies oft he original documents that will be used for research, if necessary, in order to safeguard the original documents). Also, as previously reported, NARA recommended copying of maps from eight oversized boxes for preservation purposes. Several of the large maps were too big for NARA's copiers. Remediation of these maps by the contractor was also completed during this reporting period. The large maps were cleaned, repaired and, when possible, flattened. OTR reviewed the maps after they were treated and determined that the maps will be copied, on a case by case basis, when requested by researchers. Records Retention Schedules The Archivist of the United States approved the BIA Geographic Information System (GIS) electronic record schedule on March 30, 2007. As previously reported, records retention schedules for thirteen BIA electronic records systems were forwarded to NARA in November and December 2006. NARA is reviewing the records schedules and has requested additional information on six systems. Records retention schedules for three OST electronic records systems were developed and forwarded to NARA during the last week of December 2006. NARA is reviewing the OST electronic systems records schedules and has requested additional information on two systems. Paper records retention schedules for all OST offices were sent to NARA for review and approval during this reporting period. NARA has informed OTR that it is anticipated that schedules will be forwarded to the Archivist of the United States in the next reporting period. Delays and Obstacles Lack of Internet access continues to hinder OTR's ability to provide remote access to the record index database for authorized users of the records. If Internet access were available, authorized researchers could conduct their searches from their respective work sites and only visit AIRR when necessary to inspect specific boxes or request documents from specific boxes.

16

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 24 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE Ma~ 1, 2007 Assurance Statement I concur with the content of the information contained in the Office of Trust Records section of the Status Report to the Court Number Twenty-Nine. The information provided in this section is accurate to the best of my knowledge. Date: April 18, 2007 Name: Signature on File Ethel J. Abeita Director, Office of Trust Records Office of the Special Trustee for American Indians Office of Trust Records

17

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 25 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE ,Ma~ 1, 2007 3. Introduction Interior has a continuing responsibility to provide adequate staffing, supervision and training for trust fund management and accounting activities. Fiduciary trust training is essential to the success of Interior's trust reform efforts and forms an integral part of all training for Interior employees who are involved in the management of Indian trust assets. Current Status During this reporting period, Cannon Financial Institute personnel presented: One Indian Fiduciary Trust Principles course to 22 OST, BIA and tribal personnel. Completion of this course, passing an exam and reviewing a DVD entitled Fiduciary Concepts are requirements of the Certified Indian Fiduciary Trust Analyst certification. Five specialty courses to 70 OST and BIA personnel. The specialty courses, Risk Management, Probate, Trust Accounting, Asset Management, and Fiduciary Behavior and Guardianships are part of the Certified Indian Fiduciary Trust Specialist certification program. During this reporting period, OST training staff conducted 10 training sessions for 114 OST, BIA, and contractor staff on the use of TFAS and related systems and reporting programs that include: ¯ ¯ CSS - used to enter, approve and post cash transactions; Stratavision - contains daily, weekly and monthly reports from OST systems for viewing by OST and BIA staff; Historical Query Database - contains account transaction history going back to 1985; and TFR- Trust Funds Receivable - used for tracking lockbox receipts. Indian Fiduciar~ Trust Trainin~ Program INDIAN FIDUCIARY TRUST TRAINING PROGRAM

¯ ¯

OST and BIA staff presented one Trust Fundamentals" course to 16 OST and DOI University staff. This course includes such topics as the history and policy of Indian trust, current trust reform activities, job roles and responsibilities, and organization and working relationships. Delays and Obstacles The lack of Internet access inhibits electronic communication with other governmental agencies and contractors, hinders the research of training tools and potential contractors, and restricts OST's ability to access online training programs.

23

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 26 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE May 1, 2007 Indian Fiduciar~ Trust Trainin~ Program

Assurance Statement I concur with the content of the information contained in the Indian Fiduciary Trust Training Program section of the Status Report to the Court Number Twenty-Nine. The information provided in this section is accurate to the best of my knowledge. Date: April 23, 2007 Name: Signature on File Dianne M. Moran Director, Office of Trust Training Office of the Special Trustee for American Indians

24

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 27 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE Ma~ 1, 2007 V. OTHERTOPICS A. INFORMATION TECHNOLOGY Introduction This section describes the status of Interior IT systems, particularly the systems that house or provide access to IITD or provide various computing capabilities, including functions critical to the proper administration of the individual Indian trust responsibilities within Interior. In addition, this section describes various efforts being made to improve IITD security within Interior, pursuant to OMB Circular A-130 Appendix III, and challenges due to no Internet connectivity at four bureaus. Accomplishments Computer Security: Interior continues to make progress in enhancing IT security through improvements to the vulnerability scanning process and the re-Certification & Accreditation of systems. The most noteworthy accomplishments, completions and challenges during the reporting period are described below. Prevention and Monitoring ¯ ESN is working with BIA to improve the strength offirewall configurations and the functionality of the BIA Intrusion Detection System for TrustNet. ¯ ESN has implemented a new product for ongoing assessment of external vulnerabilities which is part of Interior's proactive monitoring program. ¯ During the reporting period ESN perimeter security controls successfully blocked more than one million network attacks. Policies and Guidance ¯ On January 16, 2007, the acting Interior CIO issued "Security Threats Posed by Trusted Insiders" to bureau and office CIOs. This memo summarized the IT security risks posed by trusted insiders and reiterated the risk mitigation activities that bureaus and offices should undertake to address these threats. ¯ On February 26, 2007, the acting Interior CIO issued "Fiscal Year (FY2007) Annual End-User Federal Information Systems Security Awareness Training" to assistant secretaries and heads of bureaus and offices. This memo requires all users of Interior IT systems to complete annual security awareness training no later than July 31, 2007. ¯ On March 22, 2007, the Deputy Secretary issued "Cyber Security Responsibilities" to all Interior employees and contractors. This memo reminded all employees and contractors of their obligation to be knowledgeable about their roles and responsibilities in terms of cyber security. Information Technolo~

41

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 28 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE M,a~ 1, 2007 Information Technolo~

Plan of Action and Milestones: As reported to OMB, Interior has continued to remediate and close out a significant number of weaknesses, eliminating 418 during this reporting period. However, 542 new weaknesses were identified and added; many resulted from self-assessments, independent financial audits and findings based on OIG reports. This reflects Interior's proactive efforts to identify, track and correct security weaknesses. Interior continues to address the remaining 2,014 open weaknesses. ¯ All weaknesses are categorized as having a risk impact level of high, medium or low. These ratings are used to prioritize efforts to correct weaknesses. Of the 2,014 open weaknesses, 474 (23.5%) are rated high, 997 (49.5%) are rated medium and 543 (27%) are rated low. ¯ The POA&M statistics include NPS and USGS, which are not trust bureaus. POA&M statistics for trust bureaus are: 155 (14.6%) high, 474 (44.6%) medium, 433 (40.8%) low, for a total of 1,062. ¯ During the reporting period, Interior submitted to OMB corrected POA&M data for the first quarter of FY2007 as follows: 256 weaknesses closed, 444 new weaknesses identified and a total of 1890 open weaknesses. IT Systems Architecture: ¯ Interior completed the final draft of the Management Planning and National Environmental Policy Act (NEPA) architectural blueprint. The architectural blueprint recommends business, data, service and technology improvements for Interior land use planning in compliance with NEPA. NEPA affects the management of both federal and Indian trust lands. Staffing: ¯ The following positions were filled during the reporting period: o NBC Deputy CIO o BIA C&A Project Manager. Current Status A-130 Certification and Accreditation: All trust systems that are currently tracked in DEAR now have full ATO status. ¯ The FWS Isolated Realty Network received full ATO status on March 9, 2007. ¯ New BIA trust systems: o The Trust Active Directory, described in the previous report to the court, received full ATO status on February 15, 2007. o All BIA LANs have been associated with one of four geographic zones. Each of these zones will be a separate C&A boundary. C&A activities for each of these four zones, is currently underway and is expected to be completed in the next reporting period.

42

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 29 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE May 1, 2007 Information Technolo~

ZANTAZ: ¯ The contract was awarded in December 2006 for the forensic analysis of the 268 blank BIA tapes documented in the Status Report to the Court Number Twenty-Five. Due to personnel changes, performance under this contract is now scheduled to begin in April 2007. ¯ As reported in the previous status report to the court, ZANTAZ received the 25 BLM tapes. During this reporting period, ZANTAZ processed the tapes for delivery of messages to the digital safe, Preparation of processed tapes for return to BLM is being performed according to Interior's tape handling policy. In February 2007, BLM's Alaska State Office experienced a problem transmitting to ZANTAZ for approximately 11 hours. During this period of time, email was not sent to ZANTAZ. The backup tapes that contain the emails that were not sent during that period are expected to be delivered to ZANTAZ for processing in the next reporting period. ¯ As reported in the prior three reports, NBC and BLM are both experiencing incompatibilities between anti-virus software and ZANTAZ software. BLM has been working with ZANTAZ to resolve the problem. BLM continues to test a new version of ZANTAZ. ¯ On March 27, 2007, ZANTAZ notified Interior that a file containing pass codes used to control access to ZANTAZ technical support services was inadvertently sent to another ZANTAZ customer. ZANTAZ customer service notified the individual receiving the file within five minutes of the error. Following investigation, ZANTAZ found no indication that the security of Interior data was compromised. ZANTAZ informed Interior that the file was immediately quarantined. ZANTAZ has changed all pass codes issued to customers to mitigate risks associated with the error. Training and Awareness: ¯ NBC has begun 2007 Role-Based Security Training as required by FISMA, and is at 35% completion for the individuals required to receive this training. ¯ Twelve BIA employees & ,contractors attended a five day training session on "Security Manager Module," a commercial software product that enhances BIA's ability to monitor and respond to network events. ¯ An MMS contractor presented a three-day Certification and Accreditation course to a number of MMS IT security personnel, This course encompassed all aspects of C&A and leads to certification as a C&A professional. Incidents: ¯ On December 28, 2006, four tribal computers, four tribal flash drives and an unknown number of tribal CDs were stolen from a 638 tribal office operated on behalfofOST and located on Yakama Nation property. This incident was reported to local police and remains under investigation. An OCIO task force evaluated the types and sensitivity of the data involved. It was determined that the data files that were stolen contained copies of information regarding real property, lessees and lessors, such as: o names and addresses of each lessee and lessor;

43

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 30 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE May 1, 2007 Information Technolo~

o lease number, term and date; o type, character and legal description of the property that is the subject of the lease appraisal; o number of acres leased, rental price per acre and total value of the lease. The analysis also determined that because the information is generally publicly available, the risk of identity theft from the compromise of this information was low. Interior expects to send a notification letter to each of the approximately 200 affected individuals. This letter summarizes the incident, the results of the analysis and recommends that individuals follow best practices for preventing identity theft by continually monitoring their credit reports. ¯ ¯ OHA reported potential misuse of a laptop computer in December 2006. The investigation of this incident by OIG is ongoing. During a routine internal review of NBC Appraisal Services Directorate records, an appraisal record containing general Indian trust data was found included in work product on an NBC network connected personal computer. However, the record did not contain IITD. The record was moved from the personal computer to a storage device. NBC Security performed a forensics analysis on the personal computer to ensure that there was no malicious code or other evidence of compromise that would have posed a threat to the information and found no such evidence. On January 18, 2007, visual evidence indicated that an attempt had been made to physically break into the BLM computer room containing the servers for the LR2000 system. The cylinder lock on the door had been scratched and rotated from its normal vertical key-insertion position. No other doors appeared to have been forced. There was no evidence that the intruder gained access. Although the lock was not compromised, BLM coordinated with GSA (the building owner) to install an additional metal plate over the lock mechanism to prevent similar break-in attempts in the future. In January 2007, a BIA contractor who was conducting probate remediation efforts for the Eastern Region shipped four BIA computers to the contractor's facility in Albuquerque. The contractor did not follow the required "'wipe and backup" procedures before shipping the computers. It is not known if the computers were encrypted or contained any sensitive information or data (e.g., privacy or trust). BIA's Office of IT Security and Privacy is in the process of assessing both Interior and bureau specific policies related to the transfer of equipment. In February 2007, a BIA Contracting Officers' Representative identified and reported to BIA OISP that incumbent contractor personnel who were retained on a newly awarded contract did not have proper background checks as required under federal guidelines. All contractor personnel who did not have a valid background investigation were immediately removed from proximity to the IT systems. Background investigations have been initiated for these individuals and are currently pending results from OPM. These individuals will not be authorized to access systems until favorable background investigations have been received.

¯

¯

¯

44

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 31 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE Ma~ 1, 2007 Information Technology"

Reports: These reports were among those issued during this reporting period. ¯ Using input provided by agency OIGs, Congressman Davis issued the Seventh Report Card on Computer Security at Federal Departments and Agencies on April 12, 2007. Interior was one of eight agencies receiving a failing grade. Overall, the government received a grade of"C-." ¯ On March 13, 2007, the OIG issued a Notice of Findings and Recommendations. This NFR indicated that during the course of an information technology security evaluation conducted March 6 - 9, 2007, the OIG was able to readily obtain unauthorized access to very sensitive information. Interior has taken the following steps to respond to this NFR and the recommendations that it contains: o Informed all bureau and office CIOs of the findings and recommendations and directed that immediate corrective action be taken. o Established an Internal Security Improvement Team to develop: ¯ additional near-term and longer-term actions needed to address specific issues related to the NFR and results of reviews and assessments of any remaining risks; an enhanced and comprehensive defense-in-depth strategy to enhance Interior's IT security posture. o Defined corrective and/or mitigating actions to be taken by all Interior bureaus and offices by April 27, 2007. The results of these actions will be reported in the next quarterly report. o As a result of this incident, the IG is conducting an investigation. Delays and Obstacles Like other federal agencies, Interior must address many challenges regarding the integration, performance, funding, security, and data integrity of IT systems. Interior initiated or completed steps to address some of the challenges reported in this and previous reporting periods. However, delays and obstacles listed below impede progress in achieving Interior's IT management goals. Staffing ¯ Interior is experiencing high staffand management turnover in critical IT positions, particularly IT security. ¯ As announced during the previous reporting period, the Interior CIO retired from federal service on January 3, 2007. The Interior Deputy Secretary named the CIO for the USGS to replace the FWS CIO as the acting Interior CIO effective March 12, 2007. ¯ The following positions remained vacant at the end of this reporting period: o Interior's Deputy CISO, Security Policy Lead and Trust Security Officer o NBC's IT Security Manager, o ESN's Enterprise Security Officer, o MMS's MRM IT Security Manager, o BLM's IT Security Manager, and o BIA's CIO.

45

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 32 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE Ma~ 1, 2007 Information Technolo~

Funding and Resources ¯ Limited congressional appropriations have impacted the ability of Interior to fill personnel vacancies, complete projects and meet deadlines. ¯ Court orders requiting bureaus to maintain email backup tapes for indefinite periods require the acquisition and maintenance of an extremely large volume of expensive backup tape media. This cost burden on Interior bureaus and offices has diverted funding from other Interior programs. Denied Internet Access Four Interior bureaus and offices (BIA, OHA, OST and SOL) have not been permitted by the Court to have Internet access since December 5, 2001. As previously reported and detailed in the Status Report to the Court Number Twenty-Eight, lack of Internet access impedes work processes and the ability to communicate effectively, both internally and externally. The following is one of many examples of how bureaus and offices are impacted by lack of Internet access: SOL is representing BLM before the administrative tribunal that hears matters pertaining to Arizona Department of Water Resources. The ALJ hearing this case is requiting electronic filings of all protests and written materials relevant to the case. However, due to lack of Internet access, SOL's difficulty in complying with this requirement has reduced its efficiency by requiring SOL attorneys to travel to BLM's office to file and obtain access to court documents. Assurance Statement I concur with the content of the information contained in the Information Technology section of the Status Report to the Court Number Twenty-Nine. The information provided in this section is accurate to the best of my knowledge. Date: April 30, 2007 Name: Signature on File Karen Siderelis Department of the Interior Chief Information Officer (Acting)

46

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 33 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE May 1, 2007 ACRONYMS AND ABBREVIATIONS 1994 Act (or Act) A-123 A-130 ADM AFMSS AIMS AIPRA AIRR ALIS ALJ ARO ARRTS ART AS-IA ASD ASM ALTO BIA BIAM BILS BISS BITSM BLM BOR BPA BRM C&A CARS CDE CFedS CFI CGI CGIS CI Manual CIFTA CIFTS CIO CIRC CISO CISSP CMS COTS American Indian Trust Fund Management Reform Act of 1994 Office of Management and Budget Circular A-123, Management's Responsibility for Internal Control Office of Management and Budget Circular A-130 Appendix III Attorney Decision Makers Automated Fluid Mineral Support System ActivCard Identity Management System American Indian Probate Reform Act American Indian Records Repository Alaska Land Information System Administrative Law Judges Alaska Region office Appraisal Request and Review Tracking System Accounting Reconciliation Tool Assistant Secretary-Indian Affairs Appraisal Services Directorate Accounting Standards Manual authority to operate Bureau of Indian Affairs Bureau of Indian Affairs Manual BLM Indian Lands Surveyors Box Index Search System Bureau Information Technology Security Manager Bureau of Land Management Bureau of Reclamation Blanket Purchase Agreement Business Reference Model Certification and Accreditation Cadastral Automated Request System Critical Data Elements Certified Federal Surveyor Continuous Forest Inventory Software vendor successor to TAAMS vendor Cadastral Geographic Information Systems Coding and Imaging Manual Certified Indian Fiduciary Trust Analyst Certified Indian Fiduciary Trust Specialist Chief Information Officer Computer Incidents Response Center Chief Information Security Officer Certified Information System Security Professional Credential Management System Commercial off-the-shelf Acronyms and Abbreviations

53

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 34 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE May 1, 2007 CP&R CPIC CSIRC CSIRT CSS CTM DAA DEAR DDoS DLRM DM DMZ DNS DOI DOP DoS Acronyms and Abbreviations Check Payment and Reconciliation Capital Planning and Investment Control Computer Security Incident Response Capability Computer Security Incident Response Team Customer StrataStation Comprehensive Trust Management Plan Designated Approving Authority DOI Enterprise Architecture Repository Distributed Denial of Service DOI Land and Resource Management Departmental Manual De-Militarized Zone Domain Name Server Department of the Interior Desk Operating Procedure Denial of Service Data Quality and Integrity Data Reference Model Enterprise Architecture Eastern Navajo Agency Eastern Oklahoma Region office Electronic Records Era Eastern Region office Enterprise Services Network Enterprise Transition Plan Facilities Asset Management System Federal Acquisition Regulation Financial Business Management System Federal Financial Management Improvement Act Farmington Indian Minerals Office Federal Information Processing Standards Federal Information Security Management Act Federal Managers' Financial Integrity Act Freedom of Information Act Federal Records Center Functional Requirements Document Fiduciary Trust Model Fiduciary Trust Officer U.S. Fish and Wildlife Service Government Accountability Office Geographic Coordinate Data Base Geographic Information System General Land Office Great Lakes Agency Database System Great Plains Region office

DQ&I
DRM EA ENA EORO ERA ERO ESN ETP FAMS FAR FBMS FFMIA FIMO FIPS FISMA FMFIA FOIA FRC FRD FTM FTO FWS GAO GCDB GIS GLO GLADS GPRO

54

Case 1:06-cv-00945-FMA

Document 19-8

Filed 06/21/2007

Page 35 of 38

STATUS REPORT TO THE COURT NUMBER TWENTY-NINE Ma~ 1, 2007 GPS GSA GSS HSPD-12 IAM IATO ICR ICRs IEA IFTR IG IIM IITD ILCA ILCO ILCP IM InfoDat Interior IP IPJ IPv6 IQCS IRM IRMS IRN IRS ISSDA ISA ISIT IT ITARS ITIMS ITRS IV&V LAN LCTS LMS LR2000 LRIS LTIC LTRO MA MAD/LCP MADS Acron~cms and Abbreviatio