Thanks for linking to the reports. I pulled September’s to review and was shocked at the amount of disasters still funded for recovery/operations. Considering my own reaction, I don’t think people realize just how many simultaneous projects are still being managed and how long they’ve taken to use up funds. (Not the fault of FEMA; Louisiana apparently requested an extension to use $1.66B in 2022 as it couldn’t exhaust it by the Aug 2023 deadline.) A lot of the money is already committed or awarded and waiting to be spent. Handling so many projects at the same time explains the sudden drain you see from some months. All of this is categorized down to each region receiving funds per disaster response. Simple enough to track.
Having worked in classified areas, both as an admin and an unprivileged user, CDs were normally the method of transferring data up the network. (Transferring down rarely occurred, and even then you’d be limited to plaintext files or printouts.)
I’ve seen more places use data diodes to perform one- or two-way transfers so that requests can be streamlined and there’s no loose media to worry about tracking. It’s not super fast and higher speeds mean more expensive equipment, but it covers 98% of software update needs, and most non-admin file transfers were under 20MB anyways.
Anything that did require a USB drive, like special test equipment (STE) or BIOS updates, had to use a FIPS-140-1 approved drive that offered a ready-only mode via PIN. This drive could only be written to from a specific workstation that was isolated from the rest of the machines (where data was transferred via CDs of course) and required two persons to perform the job to ensure accountability.
Not the most time-efficient way of doing things, and not completely bulletproof, but it works well enough to keep things moving forward.