All News

Vendors still unclear about some HSPD-12 processes

More input sought for changes to product standards

Federal News Network Staff

October 13, 2008 5:35 pm

2 min read

By Jason Miller
Executive Editor
FederalNewsRadio

Vendors and agencies generally give the General Services Administration high marks for its Homeland Security Presidential Directive-12 approved products list.

The approved products list (APL) provides agencies with access to more than 300 vendors in 24 different product categories to ensure interoperability across government.

But some vendors and agencies still are confused about some of the processes around the APL.

Patrick Hearn, the vice president for the government identity market for Obetheur Technologies, says some vendors believe that the way GSA and the National Institute of Standards and Technologies change requirements is ad hoc.

“Some vendors are concerned if these changes really are based on real world experiences,” he says.

Obetheur like many companies must be on the approved product list or agencies cannot purchase their products. Hearn says that means staying ahead of new testing procedures and new standards.

Will Morrison, NASA’s identity and management official, says he understands how to use the APL, but sometimes has trouble finding a particular product or service.

He adds that he understands that the APL changes and NASA has to keep up with those changes.

But that is part of the problem, Hearn says.

While GSA is good about letting vendors know when they will be taken off the APL, Hearn says there needs to be a more formalized process to offer feedback to GSA.

“There is a fair amount of interpretation under the APL,” Hearn says. “There is only so much granularity for a specific document that when you get into APL testing, it becomes a challenge.”

David Temoshok, GSA’s director of identity management, disagrees that the APL is unclear or confusing.

He says changes to the standards and the testing process are vetted through a rigorous process.

“The process by which vendors bring products to the evaluation program is we have certified two labs and the products go directly to the labs,” Temoshok says.

“When the evaluation process is completed, we get report of whether the product has passed. It’s totally within the determination of the product vendor of their timing to get their product tested, and whether they wish to contract for additional testing.”

Temoshok adds that all products must meet the current standards.

“We will maintain the APL and the evaluation program as a way to ensure configuration management across government,” he says. “Industry and government need to stay up to date on all of those technical and requirements postings.”

Temoshok says his office also will update the Federal ID Management Handbook in 2009.

“We had one for HSPD-12 but we want to broaden the scope as we move into public key infrastructure implementation and additional authentication protocols,” he says. “We want there to be a coherent and consistent implementation across government.”

Temoshok adds that the handbooks needs to be less static and more of a living reference book for ID management implementation.

—
On the Web:

GSA – HSPD-12 approved products list