From the testimony of Robert Klopp, Deputy Commissioner of Systems and Chief Information Officer, Social Security Administration yesterday to the Subcommittee on Information Technology, House Committee on Oversight and Information Technology:
... In our last hearing, some Members voiced concerns about a lack of leadership on cybersecurity at the agency. I appreciate this concern, but I also think we need to be careful about assuming that any security weakness is the result of bad management. If the fact that there are vulnerabilities in our IT infrastructure reflects a lack of leadership, then I accept the responsibility for the lack of leadership. If the criteria is that, if DHS [Department of Homeland Security] finds anything wrong, this reflects a lack of leadership, then I accept the responsibility. But this also means that every agency that has a vulnerability, exploited or not, has a leadership issue - and that means every agency, not just SSA. ...
The SSA can shift funding from our IT budget for cyber, but soaking up any savings by spending it on cyber does not fund continuous improvement. It does not fund IT modernization. The idea that the SSA, or any agency, can do more in cyber while simultaneously rebuilding our IT infrastructure is no less a fantasy than the idea that the country can modernize any other infrastucture - our roads, our dams, our electric grid, our military - without an investment.
My testimony includes a request to modernize IT and to fund improvements in cyber defenses. Wishing for better IT from cost cutting will not help. Wishing for cost-cuts with no investment will not help. Passing legislation without providing funding is not enough. ...



