A July 2010 survey found that most of the federal chief information officers (CIOs) and chief information security officers (CISOs) surveyed had not used CyberScope, the federal online system for FISMA reporting. Among nonusers, many said they did not understand the tool’s goals or submission requirements, and respondents were uncertain that the change would improve security or reduce costs. These were early perceptions from a small survey—not measured results or a description of federal practice today.
What CyberScope was intended to do
CyberScope was an online reporting system for federal agencies’ submissions under the Federal Information Security Management Act (FISMA). The 2010 SecurityWeek account described it as an Obama administration initiative intended to streamline reporting and improve analysis. In the article’s framing, “FISMA 2.0” refers to this effort to change and modernize the reporting process; it should not be read as evidence of a current system or a measured security improvement.
As an Amazon Associate I earn from qualifying purchases.
MeriTalk conducted the survey in July 2010, asking 34 federal CIOs and CISOs about CyberScope. SecurityWeek reported the results in an article about a MeriTalk report titled FISMA’s Facelift: In the Eye of the Beholder?. MeriTalk’s report page is available here.
What surveyed nonusers understood—and questioned
SecurityWeek reported the following results for CIOs and CISOs who had not used CyberScope. The percentages describe survey responses, not agency-wide measurements; the accessible account does not state the nonuser group’s size or reproduce the questionnaire.
#1 Best Overall
| Survey finding among nonusers | Reported share |
|---|---|
| Did not clearly understand CyberScope’s mission and goals | 72% |
| Did not clearly understand the submission requirements | 90% |
| Were unsure the process would improve security oversight | 55% |
| Were unsure it would make federal networks more secure | 69% |
| Thought the changes would increase submission costs | 55% |
The clearest signal is a gap between introducing a reporting tool and making its purpose and requirements understandable to the people expected to use it. The security and cost figures, by contrast, record expectations: they do not establish whether CyberScope ultimately changed security outcomes or agency spending.
Use was limited, while the small user group gave favorable grades
As of July 2010, 85% of the surveyed federal security leaders had not used CyberScope, according to SecurityWeek’s account of the MeriTalk survey. The article does not give the exact number who had used it. It says every surveyed user gave the tool an “A” or “B,” while describing that user group as small. Without the group size or fuller methodology, those grades are a favorable but limited signal—not a robust comparison between users and nonusers or proof of effectiveness.
The approaching reporting deadline raised the stakes
The article said the Office of Management and Budget (OMB) had set November 15, 2010, as the deadline for agencies to submit FISMA reports through CyberScope. That deadline helps explain why understanding the submission process mattered: the survey captured views during initial adoption, shortly before agencies were expected to use the system for reporting. It does not indicate what agencies did after the deadline.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the article argued OMB should do
The SecurityWeek article’s interpretation was that OMB needed to communicate more clearly about CyberScope, explain submission requirements, train agencies for the change in protocol, and use early adopters’ examples to show the tool’s benefits. These were recommendations in the article’s account, not outcomes demonstrated by the survey.
The article quoted Steve O’Keeffe, founder of MeriTalk, saying, “You only get one opportunity to make a first impression.” O’Keeffe also argued that communication about the new approach had been “spotty at best” and urged OMB to explain CyberScope’s goals, progress, value, and measurement framework. Tom Conway, identified in the article as McAfee’s director of Federal business development, encouraged federal agencies to embrace the tool ahead of the November deadline. Both speakers had organizational affiliations—the first with the survey producer and the second with a technology vendor—so their remarks are best understood as attributed commentary rather than independent evidence of CyberScope’s results.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What this 2010 survey can—and cannot—tell readers
The survey is a historical snapshot of 34 federal CIOs and CISOs during CyberScope’s early adoption period. The accessible SecurityWeek account does not provide the questionnaire, sampling frame, response rate, exact number of users, or full methodology. Its percentages therefore should not be generalized to every federal agency or treated as measured impacts on security, reporting costs, or oversight. The evidence supports a narrower conclusion: among the surveyed nonusers, uncertainty about goals and requirements was widespread, while opinions about security and cost were predictions.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
