44
1 OMB A-11 IT OMB A-11 IT Management and Management and Reporting Reporting Office of Management and Office of Management and Budget Staff Budget Staff May 6 and 7, 2003 May 6 and 7, 2003

OMB A11 IT Management

  • Upload
    mricky

  • View
    719

  • Download
    1

Embed Size (px)

DESCRIPTION

 

Citation preview

Page 1: OMB A11 IT Management

11

OMB A-11 IT Management OMB A-11 IT Management and Reportingand Reporting

Office of Management and Budget Office of Management and Budget StaffStaff

May 6 and 7, 2003May 6 and 7, 2003

Page 2: OMB A11 IT Management

22

AgendaAgenda

Building Better Business CasesBuilding Better Business Cases High level discussion of changes for FY05High level discussion of changes for FY05 Individual Areas of the Business CasesIndividual Areas of the Business Cases IT Security and PrivacyIT Security and Privacy Integration into the Budget ProcessIntegration into the Budget Process

Federal Enterprise ArchitectureFederal Enterprise Architecture

View from the Resource Management Office View from the Resource Management Office (Budget)(Budget)

Financial Management ReportingFinancial Management Reporting

Page 3: OMB A11 IT Management

33

Changes from FY04 to FY05Changes from FY04 to FY05

Section 53 Section 53 All terminology changed from IT project to IT All terminology changed from IT project to IT

InvestmentInvestment Requirement for Draft Exhibit 53 (Summer)Requirement for Draft Exhibit 53 (Summer) Federal Enterprise Architecture is addedFederal Enterprise Architecture is added What it means to be Green addedWhat it means to be Green added Linkage to the FEA is added to the Unique Linkage to the FEA is added to the Unique

Investment IdentifiersInvestment Identifiers

Page 4: OMB A11 IT Management

44

Changes from FY04 to FY05Changes from FY04 to FY05

Exhibit 53Exhibit 53 Unique Investment IdentifierUnique Investment Identifier Unique Investment Identifier (FY2004 Process)Unique Investment Identifier (FY2004 Process) Investment TitleInvestment Title Investment DescriptionInvestment Description Total Investments for 2003, 2004, and 2005Total Investments for 2003, 2004, and 2005 Financial percentageFinancial percentage IT Security percentageIT Security percentage Homeland Security Priority IdentifierHomeland Security Priority Identifier Development, modernization, enhancement for 2003, Development, modernization, enhancement for 2003,

2004, 20052004, 2005 Steady State for 2003, 2004, 2005Steady State for 2003, 2004, 2005

Page 5: OMB A11 IT Management

55

Changes from FY04 to FY05Changes from FY04 to FY05

Major Investment definition:Major Investment definition: investment was a major investment in the FY 04 submission and investment was a major investment in the FY 04 submission and

is continuing; is continuing; investment is financial management and spends more than investment is financial management and spends more than

$500,000;$500,000; investment is directly tied to the top two layers of the Federal investment is directly tied to the top two layers of the Federal

Enterprise Architecture (Services to Citizens and Mode of Enterprise Architecture (Services to Citizens and Mode of Delivery); Delivery);

investment is an integral part of the agency’s modernization investment is an integral part of the agency’s modernization blueprint (EA); blueprint (EA);

investment has significant program or policy implications; investment has significant program or policy implications; investment has high executive visibility; investment has high executive visibility; investment is defined as major by the agency’s capital planning investment is defined as major by the agency’s capital planning

and investment control process;and investment control process; OMB may work with the agency to declare other projects as OMB may work with the agency to declare other projects as

major investments. major investments.

Page 6: OMB A11 IT Management

66

Changes from FY04 to FY05Changes from FY04 to FY05

Section 300Section 300 Location in the budget added to the introductionLocation in the budget added to the introduction PART Review QuestionsPART Review Questions All terminology for IT changed to investmentsAll terminology for IT changed to investments Federal Enterprise Architecture addedFederal Enterprise Architecture added More specificity in every sectionMore specificity in every section Multi-Agency Business Cases and requirementsMulti-Agency Business Cases and requirements One business case for office automation, infrastructure, and One business case for office automation, infrastructure, and

telecommunicationstelecommunications All 300s must be in XML in order to be part of the budget All 300s must be in XML in order to be part of the budget

submissionsubmission Government FTE added to the summary of spendingGovernment FTE added to the summary of spending Intro added for each section identifying how to successfully Intro added for each section identifying how to successfully

address the sectionaddress the section

Page 7: OMB A11 IT Management

77

Building Better Business CasesBuilding Better Business Cases

I.A. Investment Description & I.B. JustificationI.A. Investment Description & I.B. Justification A collaborative investment that includes multiple agencies, state, A collaborative investment that includes multiple agencies, state,

local, or tribal governmentslocal, or tribal governments Supports the President’s Management AgendaSupports the President’s Management Agenda uses e-business technologiesuses e-business technologies investment is governed by citizen needsinvestment is governed by citizen needs supports the Federal Business Architecture published by OMBsupports the Federal Business Architecture published by OMB If investment is a steady state investment, then an E-Gov If investment is a steady state investment, then an E-Gov

strategy review is underway and includes all of the necessary strategy review is underway and includes all of the necessary elements elements

If appropriate, this investment is fully aligned with one or more of If appropriate, this investment is fully aligned with one or more of the President's E-Gov initiatives the President's E-Gov initiatives

I.C. Performance Goals and MeasuresI.C. Performance Goals and Measures FEA will be discussed later in the presentationFEA will be discussed later in the presentation

Page 8: OMB A11 IT Management

88

Building Better Business CasesBuilding Better Business Cases

I.D. Project ManagementI.D. Project Management Project is very strong and has resources in place to manage it.Project is very strong and has resources in place to manage it. Project Managers are in place and successfully managing the Project Managers are in place and successfully managing the

projectproject Integrated Project Teams are in place and include the correct Integrated Project Teams are in place and include the correct

skill setsskill sets Members, Roles, qualifications, and contact information for in-Members, Roles, qualifications, and contact information for in-

house and contract managershouse and contract managers Identification of a Project ManagerIdentification of a Project Manager Identification of a ContractingIdentification of a Contracting Integrated Project TeamIntegrated Project Team Sponsor/Owner Assigned? Identified?Sponsor/Owner Assigned? Identified? Additional Information:Additional Information:

OMB Capital Programming Guide OMB Capital Programming Guide OPMOPM

Page 9: OMB A11 IT Management

99

Building Better Business CasesBuilding Better Business Cases

I.F. Risk Inventory & AssessmentI.F. Risk Inventory & Assessment

All 19 items addressedAll 19 items addressed Risk Assessment performed at outset & managed throughout Risk Assessment performed at outset & managed throughout

the life-cyclethe life-cycle Status of Risk as of the date of the business caseStatus of Risk as of the date of the business case

In column for status: If not completed, show the milestone(s) for In column for status: If not completed, show the milestone(s) for completion of risk mitigationcompletion of risk mitigation

Date of the most recent Risk Management PlanDate of the most recent Risk Management Plan

Page 10: OMB A11 IT Management

1010

Building Better Business CasesBuilding Better Business Cases

I.E. Alternative AnalysisI.E. Alternative Analysis Identify all viable alternativesIdentify all viable alternatives Select the top 3 Viable AlternativesSelect the top 3 Viable Alternatives Market ResearchMarket Research Discuss the market research that was done to identify innovative Discuss the market research that was done to identify innovative

solutions for this investment (e.g., used an RFI to obtain 4 solutions for this investment (e.g., used an RFI to obtain 4 different solutions to evaluate, held open meetings with different solutions to evaluate, held open meetings with contractors to discuss investment scope, etc.,). Also describe contractors to discuss investment scope, etc.,). Also describe what data was used to make estimates: past or current contract what data was used to make estimates: past or current contract prices for similar work, contractor provided estimates from RFIs prices for similar work, contractor provided estimates from RFIs or meetings, general market publications, etc.or meetings, general market publications, etc.

Page 11: OMB A11 IT Management

1111

Building Better Business CasesBuilding Better Business Cases Life cycle costs analysis for each alternativeLife cycle costs analysis for each alternative

– – Provide Assumptions. What data was used to make the Provide Assumptions. What data was used to make the estimatesestimates

Chosen alternative and whyChosen alternative and whyDefine return on investmentDefine return on investment

Risk adjusted/Quantitative benefits-savings, otherRisk adjusted/Quantitative benefits-savings, other Net Present Value by Year and Payback Period Net Present Value by Year and Payback Period

CalculationsCalculations Date of the Benefits Costs AnalysisDate of the Benefits Costs Analysis

Page 12: OMB A11 IT Management

1212

Investments not assessing 3 Investments not assessing 3 viable alternatives viable alternatives

Consequences:Consequences: Most cost effective

solution providing greatest benefits not chosen

Opportunities to collaborate are missed

Innovative solutions are not pursued

No backup plan if alternative chosen isn’t the right one

Steps For Steps For Strengthening:Strengthening:

Identify all possible alternatives and then down-select

Increase Market research to identify innovative solutions

Benchmark against private industry

Use consistent financial criteria across alternatives

Page 13: OMB A11 IT Management

1313

Building Better Business CasesBuilding Better Business Cases

Acquisition StrategyAcquisition Strategy Single or Several ContractsSingle or Several Contracts

What type of contract/task order if single What type of contract/task order if single

If multiple contract/task orders will be used discuss the type, If multiple contract/task orders will be used discuss the type, how they relate to each other to reach the investment how they relate to each other to reach the investment outcomes, and how much each contributes to the outcomes, and how much each contributes to the achievement of the investment cost, schedule and achievement of the investment cost, schedule and

performance goals.performance goals. Discuss the contract/task order solicitation or contract Discuss the contract/task order solicitation or contract

provisions that allow the contractor to provide provisions that allow the contractor to provide innovative, transformational solutions.innovative, transformational solutions.

Page 14: OMB A11 IT Management

1414

Building Better Business CasesBuilding Better Business Cases

Acquisition Strategy ContinuedAcquisition Strategy Continued Performance-Based – if not why not. Performance-Based – if not why not. For other that firm-fixed price, performance-based contracts, For other that firm-fixed price, performance-based contracts,

define the risk not sufficiently mitigated in the risk mitigation define the risk not sufficiently mitigated in the risk mitigation plan, for that contract/task order, that requires the Government plan, for that contract/task order, that requires the Government to assume the risk of contract achievement of cost, schedule to assume the risk of contract achievement of cost, schedule and performance goals. Explain the amount of risk the and performance goals. Explain the amount of risk the government will assume. government will assume.

Will you use financial incentives to motivate contractor Will you use financial incentives to motivate contractor performance (e.g. incentive fee, award fee, etc.)?performance (e.g. incentive fee, award fee, etc.)?

Discuss the competition process used for each contract/task Discuss the competition process used for each contract/task order? order?

Full and Open – Limited using schedule or commercial item, etc.Full and Open – Limited using schedule or commercial item, etc.

Page 15: OMB A11 IT Management

1515

Building Better Business CasesBuilding Better Business Cases

Acquisition Strategy ContinuedAcquisition Strategy Continued Will you use commercially available or COTS products for this Will you use commercially available or COTS products for this

investment?investment? If yes, to what extent will these items be modified to meet the If yes, to what extent will these items be modified to meet the

unique requirements of this investment?unique requirements of this investment? What prevented the use of COTS without modification?What prevented the use of COTS without modification? If no. Why?If no. Why?

Page 16: OMB A11 IT Management

1616

Building Better Business CasesBuilding Better Business Cases

Acquisition Strategy Continued…Acquisition Strategy Continued… How will you ensure Section 508 compliance?How will you ensure Section 508 compliance?

What is the date of your acquisition plan?What is the date of your acquisition plan? Keep it updatedKeep it updated

Percentage of hardware acquisitionPercentage of hardware acquisition Percentage of software acquisitionPercentage of software acquisition Percentage of services acquisitionPercentage of services acquisition

Page 17: OMB A11 IT Management

1717

Investments not adequately Investments not adequately planning and managing acquisitionsplanning and managing acquisitions

Consequences:Consequences:

Unclear contracts do not mitigate risk to the government

Relationship between primes and subcontractors not well designed thereby adding to the risk

Failure to include procurement experts may not identify smartest choices

Steps For Steps For Strengthening:Strengthening:

Increase the use of performance based contracts

Reduce use of Time and Material contracts

Ensure that modernization strategies include performance based criteria

Ensure the procurement shop is an integral player

Page 18: OMB A11 IT Management

1818

Building Better Business CasesBuilding Better Business Cases

I.H. Investment and Funding PlanI.H. Investment and Funding Plan Provides Project Management information on total project – Both Provides Project Management information on total project – Both

Contractor and Government EffortsContractor and Government Efforts

Government personnel costs = salaries plus fringe benefits Government personnel costs = salaries plus fringe benefits of 32.5% of government personnel considered to be direct of 32.5% of government personnel considered to be direct and indirect labor in support of the project. Includes the and indirect labor in support of the project. Includes the project management IPT and any other government effort project management IPT and any other government effort (e.g., programming effort for part of the overall project (e.g., programming effort for part of the overall project development effort) that contributes to the success of the development effort) that contributes to the success of the project. project.

Page 19: OMB A11 IT Management

1919

Building Better Business CasesBuilding Better Business Cases

I.H. Investment and Milestone Funding PlanI.H. Investment and Milestone Funding Plan Must use Earned Value Management System that meets Must use Earned Value Management System that meets

ANSI/EIA Standard 748 ANSI/EIA Standard 748 Must demonstrate that the investment is meeting the planned Must demonstrate that the investment is meeting the planned

cost, schedule and performance goalscost, schedule and performance goals Use Operational Analysis for Steady StateUse Operational Analysis for Steady State Use both for mixed life-cycleUse both for mixed life-cycle Lots of information about EVMS at www.acq.osd.mil/pmLots of information about EVMS at www.acq.osd.mil/pm

Page 20: OMB A11 IT Management

2020

Government Establishes the Government Establishes the Framework for the InvestmentFramework for the InvestmentAgency contract defines outcome/output requirementsAgency contract defines outcome/output requirementsContract requires contractor to use EVMS - ANSI/EIA 748, to build Contract requires contractor to use EVMS - ANSI/EIA 748, to build proposal, manage contract performance, and submit EVMS data to proposal, manage contract performance, and submit EVMS data to Government. Government. Contract defines EVMS software Government will use.Contract defines EVMS software Government will use.Process Govt will use to verify 748 system Process Govt will use to verify 748 system

Page 21: OMB A11 IT Management

2121

ESTABLISH THE BASELINEESTABLISH THE BASELINE1.1. DEFINE THE WORKDEFINE THE WORK

TIME

2. SCHEDULE THE WORK

3. ALLOCATE BUDGETS

$

100

8060

2040 15

40

Page 22: OMB A11 IT Management

2222

I.H.2 Original BaselineI.H.2 Original Baseline

Cost and schedule goals for phase or segment/module Cost and schedule goals for phase or segment/module of investmentof investmentMajor investment milestonesMajor investment milestones

When will they occur and costWhen will they occur and cost Funding agency for each milestoneFunding agency for each milestone

This baseline is include in all subsequent reports, even This baseline is include in all subsequent reports, even when OMB has approved changes shown in I.H.3when OMB has approved changes shown in I.H.3

Page 23: OMB A11 IT Management

2323

I.H.3 Proposed/Current I.H.3 Proposed/Current BaselineBaseline

When there are changes needed to original baseline or When there are changes needed to original baseline or current OMB approved baseline. current OMB approved baseline.

Shows new milestones and costsShows new milestones and costs

BLANK if no changes to original baseline.BLANK if no changes to original baseline.

Page 24: OMB A11 IT Management

2424

I.H.4.A Actual Performance and I.H.4.A Actual Performance and VarianceVariance

All of I.H.4 is always filled in to show current status All of I.H.4 is always filled in to show current status of investment.of investment. Compares OMB approved baseline and actual outcomes Compares OMB approved baseline and actual outcomes for phase, segment/module by milestone for phase, segment/module by milestone Shows baseline completion date and new estimated Shows baseline completion date and new estimated completion date, baseline costs and new estimate to completion date, baseline costs and new estimate to complete. complete.

Page 25: OMB A11 IT Management

2525

I.H.4.B Investment Summary I.H.4.B Investment Summary

As of date___ Must show:As of date___ Must show:

Budgeted Cost of Work Scheduled (BCWS)Budgeted Cost of Work Scheduled (BCWS)

Budgeted Cost of Work Performed (BCWP)Budgeted Cost of Work Performed (BCWP)

Actual Cost of Work Performed (ACWP)Actual Cost of Work Performed (ACWP)

Cost curve plotting BCWS, BCWP and ACWP on Cost curve plotting BCWS, BCWP and ACWP on monthly basismonthly basis

Page 26: OMB A11 IT Management

2626

COST PERFORMANCE REPORTINGCOST PERFORMANCE REPORTINGKEY DATA ELEMENTSKEY DATA ELEMENTS

$(000)

2,750

2,500

2,250

2,000

1,750

1,500

1,250

1,000

750

500

250

J F M A M J J A O N D J F M A M J J A O N D J F

Contract Target Cost

ReportingCut-OffDate

Actual Costs

Budgeted Cost forWork Scheduled (BCWS)Planned accomplishment)

Cost Variance

Schedule Variance(Dollars)

Budgeted Cost for WorkPerformed (BCWP)(Actual Accoplishment)

Projected Slipage

Budgeted CostAt Completion

ProjectedOverrun

Estimated Cost at Completion

Page 27: OMB A11 IT Management

2727

Earned Value Trend AnalysisEarned Value Trend Analysis

Page 28: OMB A11 IT Management

2828

I.H.4.B.4 (Cont.) Provide the I.H.4.B.4 (Cont.) Provide the following EVMS Analysisfollowing EVMS Analysis

Cost Variance $ and %Cost Variance $ and %

Cost performance indexCost performance index

Schedule Variance $ and % Schedule Variance $ and %

Schedule Performance IndexSchedule Performance Index

Two independent Estimate At CompletionTwo independent Estimate At Completion

Variance at Completion for both EACsVariance at Completion for both EACs

Page 29: OMB A11 IT Management

2929

I.H.4.C and D I.H.4.C and D

C - Analysis of the reasons for cost and schedule C - Analysis of the reasons for cost and schedule variances of 10% or more at time of report or EAC is variances of 10% or more at time of report or EAC is projected to by 10% or moreprojected to by 10% or more

D – Provide performance varianceD – Provide performance variance

Explain whether IPT still expects to achieve performance Explain whether IPT still expects to achieve performance goals. If not, explain reasonsgoals. If not, explain reasons

Page 30: OMB A11 IT Management

3030

I.H.4.E, F and GI.H.4.E, F and G

E - Discuss estimate to complete (EAC)E - Discuss estimate to complete (EAC) ContractorContractor Two commonly used EAC formulasTwo commonly used EAC formulas Rationale for the EAC chosen by IPTRationale for the EAC chosen by IPT

F - Corrective actions with risk - How close to original F - Corrective actions with risk - How close to original goals will be result goals will be result G - Agency Head concurrence to continueG - Agency Head concurrence to continue

Page 31: OMB A11 IT Management

3131

Operating investmentsOperating investments

Must be monitored with an Operational Analysis System Must be monitored with an Operational Analysis System to track:to track:

How close actual annual operating and maintenance costs are to How close actual annual operating and maintenance costs are to the original life-cycle estimatesthe original life-cycle estimates

Whether level or quality of performance /capability meets Whether level or quality of performance /capability meets performance goals and continues to meet user needsperformance goals and continues to meet user needs

Page 32: OMB A11 IT Management

3232

Addressing IT Security, Addressing IT Security, Homeland Security, and Homeland Security, and

Privacy in IT Budget Privacy in IT Budget MaterialsMaterials

Kamela WhiteKamela White

Information Policy and TechnologyInformation Policy and Technology

Office of Management and BudgetOffice of Management and Budget

[email protected]@omb.eop.gov

Page 33: OMB A11 IT Management

3333

IT Budget MaterialsIT Budget Materials

Exhibit 53, IT PortfolioExhibit 53, IT Portfolio IT SecurityIT Security Homeland SecurityHomeland Security

300, Capital Asset Plan and Business Case300, Capital Asset Plan and Business Case IT SecurityIT Security Homeland SecurityHomeland Security PrivacyPrivacy

Page 34: OMB A11 IT Management

3434

Exhibit 53 Exhibit 53

IT SecurityIT Security Must report security costs per systemMust report security costs per system Associate spending with level of performance Associate spending with level of performance 0 = no security controls0 = no security controls Provide additional information where necessaryProvide additional information where necessary

What should security costs consist of?What should security costs consist of? Products, procedures, personnel, etc. that are Products, procedures, personnel, etc. that are

primarily dedicated to or used for provision of security primarily dedicated to or used for provision of security controls:controls:

employee training, security inspections and audits, employee training, security inspections and audits, vulnerability and penetration testing.vulnerability and penetration testing.

Page 35: OMB A11 IT Management

3535

Exhibit 53 – IT Security (continued)Exhibit 53 – IT Security (continued)

Products, procedures, personnel, etc. that have as an Products, procedures, personnel, etc. that have as an integral component a quantifiable benefit to security:integral component a quantifiable benefit to security:

privacy training, system/program evaluations.privacy training, system/program evaluations.

Supports Homeland SecuritySupports Homeland Security means an IT investment means an IT investment that supports the homeland security mission areas of:that supports the homeland security mission areas of:

Intelligence and Warning,Intelligence and Warning, Border and Transportation Security,Border and Transportation Security, Defending Against Catastrophic Threats,Defending Against Catastrophic Threats, Protecting Critical Infrastructure and Key Assets,Protecting Critical Infrastructure and Key Assets, Emergency Preparedness and Response, andEmergency Preparedness and Response, and Other. Other.

Page 36: OMB A11 IT Management

3636

Exhibit 300 – Part I. Capital Exhibit 300 – Part I. Capital Asset Plan and Business CaseAsset Plan and Business CaseIT SecurityIT Security

Was this investment reviewed as part of the FY03 Federal Was this investment reviewed as part of the FY03 Federal Information Security Management Act review process?Information Security Management Act review process?

If yes, were any weaknesses found? If yes, were any weaknesses found?

Have the weaknesses been incorporated into the agency’s Have the weaknesses been incorporated into the agency’s

corrective action plans?corrective action plans?

Page 37: OMB A11 IT Management

3737

Part I. (continued)Part I. (continued)

Has this investment been identified as a national Has this investment been identified as a national critical operation or asset by a Project Matrix review critical operation or asset by a Project Matrix review or other agency determination?or other agency determination?

If no, is this an agency mission critical or essential service, If no, is this an agency mission critical or essential service, system, operation, or asset (such as those documented in system, operation, or asset (such as those documented in the agency's COOP Plan), other than those identified as the agency's COOP Plan), other than those identified as above as national critical infrastructures?above as national critical infrastructures?

Page 38: OMB A11 IT Management

3838

Part I. (continued)Part I. (continued)

Homeland SecurityHomeland Security Supports Homeland SecuritySupports Homeland Security means an IT investment that means an IT investment that

supports the homeland security mission areas of:supports the homeland security mission areas of:Intelligence and Warning,Intelligence and Warning,Border and Transportation Security,Border and Transportation Security,Defending Against Catastrophic Threats,Defending Against Catastrophic Threats,Protecting Critical Infrastructure and Key Assets,Protecting Critical Infrastructure and Key Assets,Emergency Preparedness and Response, andEmergency Preparedness and Response, andOther. Other.

PrivacyPrivacy Was a privacy impact assessment performed for this IT Was a privacy impact assessment performed for this IT

investment?investment?

Page 39: OMB A11 IT Management

3939

Part I. (continued)Part I. (continued)

Section I.F. Risk Inventory and AssessmentSection I.F. Risk Inventory and Assessment Identify security and privacy risks, also provide information of the Identify security and privacy risks, also provide information of the

level of risk (high, medium, or basic); andlevel of risk (high, medium, or basic); and What factor determined the risk level (confidentiality, integrity, or What factor determined the risk level (confidentiality, integrity, or

availability)availability)

Page 40: OMB A11 IT Management

4040

Part II. Additional Business Case Part II. Additional Business Case Criteria for ITCriteria for IT

Section II.B. Security and PrivacySection II.B. Security and Privacy How is security funded?How is security funded? Level of risk and security controls?Level of risk and security controls? Does the IT investment meet security requirements:Does the IT investment meet security requirements:

up-to-date security plan?up-to-date security plan?

fully certified and accredited?fully certified and accredited?

security controls tested?security controls tested?

users trained?users trained?

incident response capability?incident response capability?

security in contracts?security in contracts?

Page 41: OMB A11 IT Management

4141

Part II. (continued)Part II. (continued)

PrivacyPrivacy Appropriate controls to protect privacy for systems that promote Appropriate controls to protect privacy for systems that promote

or permit public access?or permit public access? Agency ensure that handling of personal information is Agency ensure that handling of personal information is

consistent with gov’t-wide and agency policies?consistent with gov’t-wide and agency policies? Performed a privacy impact assessment?Performed a privacy impact assessment?

Page 42: OMB A11 IT Management

4242

Privacy Impact Assessment (PIA)Privacy Impact Assessment (PIA)

A PIA is a process for examining the risks and ramifications of A PIA is a process for examining the risks and ramifications of collecting, maintaining, and disseminating personally identifiable collecting, maintaining, and disseminating personally identifiable information in an information system; and for identifying and information in an information system; and for identifying and evaluating alternatives and protections to mitigate the impact to evaluating alternatives and protections to mitigate the impact to privacy of collecting personal information.privacy of collecting personal information.

PIAs are required for all major IT systems and all new systems that PIAs are required for all major IT systems and all new systems that are requesting fundingare requesting funding

PIAs are required for new online information collections under the PIAs are required for new online information collections under the Paperwork Reduction Act.Paperwork Reduction Act.

Page 43: OMB A11 IT Management

4343

RMO’s ViewpointRMO’s Viewpoint1. Negotiated Process. IT and Programmatic Considerations.Emphasize that OMB-agency negotiate the process. Investments can be disapproved on either IT (300) grounds, or programmatic grounds -- or sustained for programmatic reasons while a "get well" plan is pursued with respect to weaknesses in the IT business case.

2. IT and Overall Budget Justifications Should Be Integrated. Integration Should Be Built Into An Agency's Budget Formulation Process (just as it is increasing at OMB). In FY 2005, IT justifications will matter more.IT shops and budget shops should understand well how both aspects of agency budget requests relate. More OMB account examiners and OMB analysis will be devoted to reviewing IT justifications in FY 2005 than ever before, and final budget decisions will depend on these reviews. OMB needs to understand how IT fits into overall programmatic requests across the agency. Agencies should work with their RMO on IT integration into the overall Budget Submission. E-Gov Plans should be integrated with the other PMA initiatives (Financial Management, Human Capital, Competitive Sourcing, and Budget and Performance Integration).

3. Early Submission of "Draft Exhibit 53s and Exhibit 300s." OMB will be discussing with agencies "draft Exhibit 53" submissions, to clarify early such things as expected lists of major investments, how mapping IT investments to the FEA lines of business is being addressed, how consolidated infrastructure requests will be handled, and other issues.

Page 44: OMB A11 IT Management

4444

RMO’s ViewpointRMO’s Viewpoint

4. Relation of Exhibit 300s and PARTs.If an IT investment contributes to a program with a PART, A-11 calls for addressing whether the IT investment relates to closing a gap identified in the PART.

5. Joint Business Cases. When two or more partners are working together on a investment or elements of a investment, it should be clear not just what is being done, but what unnecessary things are not being done. That is really the true test of joint business case. The managing partner will take the lead for the business case and capital asset planning, including submitting the joint 300 to OMB. Partnering agencies should ensure their collaboration and funding are appropriately represented in the 300 prior to submission to OMB. All participants will reflect multi-agency investments as specific line items on their exhibit 53s.