New Attachment 8-27-26_GPO_Config_Man_825-8b.pdf

ORIGINATING OFFICE

Information Technology

EFFECTIVE DATE

October 2, 2024

GPO Directive 825.8B October 2, 2024

Information Technology (IT) Configuration Management (CM) Policy

1. Purpose. This Directive establishes a governance policy to control changes within the

Government Publishing Office’s (GPO) IT plans, infrastructures, applications, services, and standards. The stability, reliability, and security of IT are critical to the support of the GPO mission; therefore, the introduction of new and/or changing plans, processes, standards, and technology within the GPO enterprise shall be controlled, managed, protected, and documented through defined processes. The Chief Information Officer’s (CIO) goal to deliver quality services shall be facilitated by implementing this GPO-wide configuration management (CM) policy. It consists of a multi-layered approach, which includes policy, plan, processes, and guidelines, with each layer providing an increasing detailed level of guidance. The policy will complement IT’s current IT Security, Enterprise Architecture (EA) and other practices and ensure compliance with existing IT policies.

2. Scope. The CM governance and oversight process is applicable to all GPO Business Units

(BU) and other authorized persons and contractors who plan to introduce new technology, new software applications, or implement changes that will affect the IT production environment. In addition, it applies to all GPO interfaces that access the independently managed technical resources and supporting entities. External entities supporting or providing GPO IT services or infrastructure must demonstrate to GPO they have an acceptable CM process in place. IT further includes Cloud implementations, hosting environments, as well as systems developed that will be supported on premises.

3. Cancellation. GPO Directive 825.8A, Subject: Information Technology (IT) Configuration

Management (CM) Policy, dated July 18, 2019, is hereby superseded.

4. Related GPO Directives. This policy is augmented by other GPO policies and Directives;

including but not limited to:

a. GPO Directive 705.28B, Subject: Information Technology Systems Development Life

Cycle Policy, dated October 22, 2019;

b. GPO Directive 705.31B, Subject: Enterprise Architecture (EA) Policy, dated June 5, 2019;

c. GPO Directive 705.33A, Subject: Information Technology Software License Management, dated February 25, 2021;

d. GPO Directive 705.34, Subject: GPO Cloud Computing and Hosted Services Policy, dated

March 28, 2019; and

e. GPO Directive 825.33D, Subject: Information Technology (IT) Security Program

Statement of Policy, dated February 1, 2024.

5. Policy. CM policy states that all approved changes to GPO-wide IT plans, policies, infrastructure components, operating systems, networking software, security software, 825.8B

10/02/2024 projects, applications, systems, IT products, licenses, associated configurations, and released deliverables are documented and baselined under IT CM governance. System and project specific documentation and associated approvals are submitted to CM prior to production deployment for inclusion in the system baseline. It further requires the CM process, strategy, and guidance be facilitated through a Configuration Management Plan

(CMP), Change Advisory Board (CAB), Technical Change Control Board (TCCB), and associated CM artifacts as described below.

6. Configuration Management Plan (CMP). The CMP provides guidance pertaining to configuration controls for all approved configurable items (CIs) within IT products, services, and projects. Configuration management functions as a collaborative, controlling discipline that enables changes to be made in such a way as to preserve product, service, and system integrity. It accomplishes this by providing processes, procedures, and tools to help ensure that the hardware and software systems and associated documentation are accurate and up to date. The CMP highlights the roles and responsibilities of all individual areas involved in the CM activities for a project and production systems. CMP will apply industry best practices as appropriate. Compliance with this policy will ensure that a CM Plan is followed for each IT acquisition, cloud or hosting service selection, and project implementation.

7. Change Advisory Board (CAB). A CAB is the IT group established to evaluate change requests to the technical environment for business need, priority, and potential impacts to other systems or processes. The CAB supports the CM process by making recommendations for implementation, further analysis, deferment, or cancellation. Each change request will be submitted to the CAB. IT is the default organization providing configuration management resources, controls, and ongoing status of change activity.

Configuration Control in this context refers to a systematic proposal, justification, evaluation, coordination, and approval or disapproval of proposed changes after formal establishment of its baseline. Specifically, the CAB will be responsible for the following activities:

a. Ensure all proposed changes go through an impact analysis to identify all related configuration items that could be impacted by a proposed change and determine their effect on other elements in the technical environment including performance, cost, and schedule impacts.

b. Facilitate GPO-wide working groups as required to complete impact assessments.

c. Monitor and track the status of any related incidents, requests, and other related change requests.

d. Ensure that only approved changes are implemented and baselines adjusted accordingly.

e. Determine priority and set implementation schedules.

f. Coordinate activities with other IT Governance and Oversight organizations as needed.

The CM process also incorporated a fast-track mechanism. Email communication will be utilized to facilitate this mechanism.

8. Technical Change Control Board (TCCB). The TCCB provides the forum through which

GPO evaluates all IT requests for new technologies prior to their procurement and implementation in the GPO technical environment. IT Security also participates in TCCB to ensure all requests are analyzed for adherence to IT Security and governance policies. In addition, TCCB includes all other IT divisions as well as representatives from GPO BUs.

Specifically, the TCCB reviews and approves or disapproves the technical specifications of newly proposed IT initiatives and addresses major technical issues that arise throughout the lifecycle of any IT initiative. These include managing change to the existing baselines for systems, software and hardware, and infrastructure.

The TCCB governance process commences when an executive level authority approves a request for an IT initiative. Upon commencement, a project record is generated, or a potential change to the GPO’s technical environment becomes evident. This includes but is not limited to: purchases of new software and hardware; configuration changes; or changes to existing IT infrastructure, services, systems, and applications. In addition, the TCCB ensures coordination and communication between IT projects and stakeholders to account for and manage effects resulting from changes to IT baselines and with approving technical feasibility. TCCB has no funding authority.

In addition, the TCCB becomes engaged at the time of production readiness review and provides the final approval of all production deployments and changes to Production environments. Approval requests for changes to Production environments are initiated by members of the CM Team. The Configuration Management Database (CMDB) reflects the current production state of all identified CIs. CMDB updates are either triggered by a TCCB approved RFC that is coordinated through the CM staff, or when a change is identified by IT staff, and a change request is submitted, or when the monitoring tools discover a change to a CI in the IT infrastructure.

9. CM Artifacts. They include living documents reflecting configuration identification, change management, configuration audits, configuration status, and change history reporting for the

System Environments and Applications supporting GPO’s mission. This CM governance begins once a Business Case and Vision and Concept of Operation (CONOPS) document are forwarded to IT; an IT project is initiated in any GPO BU; new information technology equipment or software is introduced; or a new system is approved and deployed to a production environment, and a baseline is established.

The attached GPO Strategic Technology Planning Diagram demonstrates the TCCB

Request Status Flow process (see attachment).

10. Roles and Responsibilities.

a. Chief Information Officer (CIO). Approval authority for policy implementation and subsequent policy changes as well as overall policy enforcement.

b. GPO BU Managers or Directors. Ensure participation and policy compliance within their respective Divisions, Branches, and work areas. If a BU internally manages change processes, it must be done in conformance to agency processes and oversight requirements specified by IT Configuration Management.

c. Program and Project Managers. Ensure policy implementation and compliance for all

GPO-wide IT initiatives.

d. IT Security. Ensure all TCCB requests are analyzed for adherence to IT Security policies and processes.

e. IT Configuration Manager. Responsible for overall implementation, management, support, and oversight of the CM Policy. Provides resources to support each BU managing change.

f. IT Change Management Team. Support the implementation and enforcement of CM policy throughout IT and in each BU managing change. Creation, implementation, and enforcement of supporting plans, processes, and procedures.

g. GPO Deputy Director. Supports policy compliance across the GPO enterprise.

The key requirement for the success of CM is the joint commitment of all levels of the management and project team to abiding by CM policies throughout the life of the product and the infrastructure supporting the product. The CM staff will ensure the availability of required GPO-wide CM tools to facilitate CM process flows, data capture, monitoring, and reporting of CM information.

11. Adherence. All information and networked technology initiatives are responsible for adherence to and implementation of this policy. Waivers from this policy requests shall comply with the GPO Configuration Management Waiver Process and be approved by the

Chief Information Officer (CIO).

12. Inquiries. For additional information about this Directive, please contact the Chief Policy

Officer (IT).

13. Effective Date. This Directive is effective upon issuance.

HUGH NATHANIAL HALPERN

Director

10/02/2024 Attachment A

TCCB Request Status Flow

Yes