12. Appendix A_ OSPO Risk Management Plan 2011 July 2011.pdf

NOAA/NESDIS/OSPO OSPO/RM-2011-Vl.0 Baseline Date: July 2011

OSPO Risk Management Plan

Office of Satellite and Product Operations

(OSPO)

OSPO Risk Management Plan

Prepared by:

U.S. Department of Commerce National Oceanic and Atmospheric Administration National Environmental Satellite, Data, and Information Service Office of Satellite and Product Operations

NOAAINESDIS/OSPO OSPO/RM-2011-Vl.0

OSPO Risk Management Plan

Office of Satellite and Product Operations (OSPO)

Risk Management Plan

July 2011

Version 1.0

Prepared by:

U.S. Department of Commerce (DOC) National Oceanic and Atmospheric Administration (NOAA)

National Environmental Satellite, Data, and Information Service (NESDIS) Office of Satellite and Product Operations (OSPO)

NOAA/NESDIS/OSPO

Document Numbers

NOAA/NESDIS/OSPO

APPROVAL PAGE

(E-Approval by E-Mail)

OSPO/RM-2011-Vl.0 Baseline Date: June 2011

OSPO Risk Management Plan

OSPO/RM-2011-Vl.0

June 2011 OSPO Risk Mana ement Plan

Office of Satellite and Product Operations (OSPO)

Risk Management Plan

PROGRAM: OSPO DOCUMENT RELEASE DA TE:

APPROVALS

GROUP: OSPO/Corporate

Keith Ambur

GROUP: OSPO/MOD GROUP: OSPO/SPSD

c/2.s/11 Mark P. Moran, OSPO/ Actin De utv Director Date

GROUP: OSPO/MOD Date GROUP: OSPO/NIC

Ron Mahmot. OSPO/MOD Division Mana er Date GROUP: Fairbanks CDAS GROUP: Wallops CDAS

Larry Ledlow, Station Manager Date Van D. Crawford, Station Manager Date

Date

Document Numbers

NOAA/NESDIS/OSPO

APPROVAL PAGE

(E-Approval by E-Mail)

OSPO/RM-2011-Vl.0 Baseline Date: June 201 I

OSPO Risk Management Plan

OSPO/Rlvl-2011-Vl.0

June2011 OSPO Risk Management Plan

Office of Satellite and Product Operations (OSPO)

Risk Management Plan

PROGRAM: OSPO I DOCUMENT RELEASE DA TE:

APPROVALS

GROUP: OSPO/Corporate Services

Keith Amburgey, Manager, Corporate Services Date

GROUP: OSPO/MOD GROUP: OSPO/SPSD

Mark P. Moran, OSPO/ Actin~ Deputy Director Date David Benner, OSPO/ SPSD, Oivision Manager Date

GROUP: OSPO/MOD Date GROUP: OSPO/NIC

Ron Mahmot, OSPO/MOD Division Manager Sharolyn Young, OSPO/NIC, Division Manager Date

GROUP: Fairbanks CDAS

Larry Ledlow. Station Manager Date Date

CMO RELEASE APPROVAL:

NAME: Kathleen A Kelly. OSPO Director Date

Baseline Date: July 2011

OSPO Risk Management Plan

APPROVAL PAGE

(E-Approval by E-Mail)

Document Numbers

NOAA/NESDIS/OSPO

OSPO/RM-2011-VJ.0

July 2011 OSPO Risk Management Plan

Office of Satellite and Product Operations (OSPO)

Risk Management Plan

PROGRAM: OSPO l DOCUMENT RELEASE DATE:

APPROVALS

GROUP: OSPO/Corporate Services

Keith Amburgey, Manager, Corporate Services Date

GROUP: OSPO/MOD GROUP: OSPO/SPSD

Mark P. Moran, OSPO/ Acting Deputy Director Date David Benner, OSPO/ SPSD, Division Manager Date

GROUP: OSPO/MOD Date GROUP: OSPO/NIC

Ron Mahmot, OSPO/MOD Division Manager Sharolyn Young, OSPO/NIC, Division Manager Date GROUP: Fairbanks CDAS GROUP: Wallops CDAS

12 July 2011

Larry Ledlow, Station Manager Date Van D. Crawford, Station Manager Date

CMO RELEASE APPROVAL:

NAME: Kathleen A. Kelly, OSPO Director Date

DOCUMENT HISTORY

DOCUMENT REVISION LOG

OSPO/RM-2011-Vl.0 Baseline Date: July 2011

OSPO Risk Management Plan

The Document Revision Log identifies the series of revision to the OSPO Risk Management Plan since the baseline release. This page will become a permanent part of this document.

I DOCUMENT TITLE: OSPO Risk Mana&ement Plan

DOCUMENT CHANGE IDSTORY

Revision I Date I Revision Originator I Approval Authority

No.

I 4/25/2011 Karl Hampton/Bruce Plott Keith Amburgey

2 5/10/2011 2020 LLC/Rahul Dayal/Clint

Sherwood

3 5/11/2011 Rahul Dayal

4 6/17/11 Karl Hampton/Rahul Dayal/Clint

Sherwood

5 7/5/1 I Karl Hampton/Clint Sherwood

6 7/7/11 Keith Amburgey/Karl Hampton

I

Baseline Date: July 2011

OSPO Risk Management Plan

LIST OF CHANGE-AFFECTED PAGES/SECTIONS/APPENDICES

Release Version Page Date Description of Change(s) Item # # of -page(s)

OSPO Risk Management Plan

1. TABLE OF CONTENTS

1. TABLE OF CONTENTS

2. Preface

3. Executive Summary ........................................ :

3 .1 Objective 3 .2 Document Organization

4. Framework: Introduction and Organization Overview

4.1 OSPO Mission Description

4.2 OSPO Functional Structure

4.2.1 Command & Control (C&C)

4.2.2 Data Processing

4.2.3 Products

4.2.4 Broadcast Services (External Services)

4.2.5 Infrastructure Service and Support (Internal Services)

5. Framework: Risk Management Strategy

5.1 General Strategy

5.2 OSPO Risk Management Plan Benefits

6. Risk Management Process

6.1 Process introduction

6.2 Roles and Responsibilities

6.3 Risk Management Tools

6.4 Steps for Risk Management Process

6.4.1 Risk Identification

6.4.2 Risk Descriptions

6.4.3 Risk Analysis

6.4.4 Risk Impact Rating

6.4.5 Risk Probability Rating

6.4.6 Risk Matrix and Rating

6.4. 7 Risk Mitigation Plans

6.4.8 Risk Monitoring, Resolution and Control

6.4.9 Risk Assessment

6.4.10 Risk Reporting and Communication

6.4.11 Tools to Communicate and Document Risks

6.5 Collaborative Risk Management

6.5.1 OSPO Risk Management Board

6.5.2 OSPO RMB Meeting Frequency

6.5.3 OSPO Risk Management (RM) Requirements

7. Process: Risk Management Considerations

7. I Principles 7 .2 RMP Policies and Guidelines 7 .3 Risk Classification

7 .3. I Reporting Category 7 .3 .2 Lifecycle Category

7.3.3 Functional Category

8. Appendix A - Key Risk Management Terms

Baseline Date: July 2011

OSPO Risk Management Plan

9. Appendix B, Supporting Documents

10. Appendix C, OSPO Risk Artifacts Templates

11. Appendix D, Acronyms

2. PREFACE

OSPO/RM-2011-VI.0

Baseline Date: July 2011

OSPO Risk Management Plan

The purpose of the Risk Management Plan (RMP) for the Office of Satellite and Product Operations (OSPO) is to help ensure the success of day-to-day OSPO operations. The RMP describes the objectives of risk management for the various functional organizations within OSPO, as defined in Section 4.2. In addition, the RMP (I) presents the risk management strategy that will be used to identify, analyze, and manage risk in OSPO; (2) defines risk-related roles and responsibilities; (3) outlines guiding risk management principles; and, (4) identifies different types of risks. OSPO will use as guidance the NIST Special Publication 800-37 Rev. I "Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach," which is the latest federal guidance provided for risk management plans.

Appendix B provides supporting documentation and references used in the preparation of this document.

3. EXECUTIVE SUMMARY

Baseline Date: July 2011 OSPO Risk Management Plan

National and international weather and climate services require timely, continuous, and global observations in order to issue watches and warnings for severe weather; to develop short, medium and long term forecasts; and to assist in climate analysis. OSPO provides command and control for NOAA and non-NOAA environmental satellites, and acquires, processes, and delivers all data delivered from these environmental satellites. OSPO products and services are used by government and non-government organizations including the U.S. Navy, U.S. Air Force, National Weather Service (NWS) and others to protect life and property. In addition to being used to issue weather watches and warnings, these products and services are used to forecast weather, manage coastal and ocean resources, and to provide a long-term, continuous record of the environment for climate analysis.

Such vital services call for the highest level of care and maintenance of the IT infrastructure that supports them. This means that managers of these resources must consider the most cost effective way to identify risk in advance and have a well-planned process in place, rather than merely responding to unforeseen emergency situations. By identifying risks in advance, managers can analyze potential consequences and assign commensurate resources that mitigate those issues if they occur, or that can prevent them from occurring at all.

The principles and recommended structure of the OSPO RMP are standard practice for risk management, but have been tailored to meet the specific needs of OSPO, with consideration for its various systems, management structures, organizations and customers. In this regard, the OSPO RMP serves as a roadmap toward an organization-wide system of cost-effective, tightly focused risk strategies and tactics that eliminate or mitigate risk, and that ensure uninterrupted delivery of weather, ocean, climate and other vital environmental data, services and information.

3.1 Objective

The objective of the RMP is to provide a repeatable, compliant, transparent, and visible method of risk management that implements a measurable process and improved risk profile. This RMP identifies five functional areas within OSPO:

1. Command and Control (C&C)

2. Data Processing and Distribution

3. Products

4. Broadcast Services (External Services)

5. Infrastructure Service and Support (Internal Services)

Section Four of the RMP ("Framework - Introduction and Organization Overview") describes these functional areas in greater detail. Figure 1 below illustrates that although the Risk Management Boards (RMB) will be the responsibility of each division, the OSPO RMB will use their input data to identify the highest risks for each functional area.

,-----< ►-------, ! Risk Management Process ir ' ...-----:--1\... ' '--------, ... ✓---'

.All/

DIVISION RISK MANAGEMENT BOARDS

MOD

Internal Data

~-_..... Broadcast Products C&C

~ Services¥ FUNCTl:e::sAR:~;ssin¥g --- r I~ ... _- ij ·---7 l !- . - . . - i' l

PROJECT / TECHNICAL TEAMS

Figure 1 - OSPO Risk Management Structure

OSPO/RM-20 I 1-V 1.0

Baseline Date: July 201 I

OSPO Risk Management Plan

OSPO Corporate Services Risk Management

Monitoring and Compliance

The RMB for each division operates with a high degree of autonomy, but is ultimately accountable to the OSPO RMB, which in turn is accountable to the director. The RMP provides a framework that encourages a free flow of information from project and technical teams to the division risk management boards, which in turn communicate with the OSPO RMB. The chairpersons of each division risk management board will have ownership of that division's risk register, and will exercise the appropriate process in escalating a risk to the level of the OSPO RMB. The RMP structure and process are designed to provide a uniform risk management process for all of OSPO, and to encourage transparency, open communication and collaboration.

It should be noted that the RMP is not an additional process, but is instead designed to provide structure and efficiency for risk management practices within OSPO. In addition, the RMP is designed to allow each functional area/organization to implement the RMP in ways that are compatible with its mission, style and existing practices. In this way, the RMP provides a flexible framework that allows each division to implement an effective risk management strategy that aligns with its mission and operation.

Oversight and ultimate accountability for OSPO implementation and ongoing operation of the RMP will be exercised by OSPO Corporate Services, as illustrated in Figure I. By monitoring

OSPO Risk Management Plan the activities of the various risk management boards, Corporate Services will ensure that the RMP process is being followed, and that the activities and products of the boards align with relevant compliance initiatives. Managing the risk management process at the division level is the responsibility of each division manager.

Risk assessments are made by the OSPO Government Technical Managers (GTM) and OSPO Product Area Leads (PAL), in conjunction with the OSPO Management Team and OSPO Contract Project Managers (CPM). The risk assessment determines the probability of an event occurring and the potential impact of that event on the project's success. Mitigation plans will be developed for all identified risk events, and contingency plans will be implemented if a risk is realized or if the mitigation plan fails. The Risk Management GTMs will ensure this approach is followed at the OSPO RMP level.

The processes described in this document will provide a framework for risk management of various functional areas and for OSPO as a whole. Risks to specific functional areas should be managed at the division level in accordance with the risk management processes established in this document as well as functional-area-specific RMPs.

3.2 Document Organization

The RMP is divided into two parts: Framework (Sections 4 and 5) and Process (Sections 6 and 7). Sections 4 and 5 provide a high-level view of the purpose, function and benefits of OSPO risk management. Sections 6 and 7 provide operational details about developing and managing a functional-level risk management plan.

Four Appendices at the end of the document (Sections 8-11) provide helpful references related to the risk management process, many of which were used in the preparation of this document.

Baseline Date: July 201 I

OSPO Risk Management Plan

4. FRAMEWORK: INTRODUCTION AND ORGANIZATION OVERVIEW

The OSPO RMP is a living document for managing risks as an ongoing, integrated practice at each OSPO operations facility. 1 The RMP describes the processes and procedures to be used to identify, analyze, communicate, and eliminate or mitigate risks that are determined by OSPO management and project/technical teams to be OSPO Program-level risks. OSPO technical teams and division management are expected to manage all operational risks according to the risk management processes defined in this RMP. Throughout the Project lifecycles, this RMP will be used to manage risks and issues impacting OSPO assets and overall OSPO mission success.

4.1 OSPO Mission Description

On February 27, 2011 the NOAA/NESDIS Office of Satellite Data Processing and Distribution (OSDPD) and the Office of Satellite Operations (OSO) combined into the OSPO. 2 OSPO manages and directs NOAA's 24x7 environmental satellite operations, including the acquisition, product development and distribution of environmental data and derived products to domestic and foreign users, and associated services. The environmental data, products, and services are used to support analyses for environmental watches, warnings, hazards, forecasts, and long-term climate analyses. OSPO works with NESDIS Offices and Centers to plan and develop new satellites and ground systems, and to support the transition of research products to operations, along with major modifications of existing systems. OSPO provides planning, management, and coordination with the National Weather Service, the U.S. Air Force, the U.S. Navy, and other users for exchange of environmental satellite data. OSPO assesses, recommends, and plans for the acquisition and initiation of environmental satellite products and services within the United States and international community. OSPO manages NOAA 's SARSA T system, and coordinates participation in the International COSPAS-SARSA T Program. OSPO manages the strategic and tactical environmental and oceanographic ice services at the National Ice Center (NIC) for the operational requirements of U.S. national interests.

1NOAA Satellite Operations Facility (NSOF), Suitland, MD; Product Operations in Camp Springs, MD; Command and Data Acquisition Station, Fairbanks, AK (FCDAS); and, Command and Data Acquisition Station, Wallops Island, VA (WCDAS)

2 The OSPO PMP provides an overview of the previous and current ESPC environment spanning the merger of the OSO and the OSDPD into the OSPO. The OSPO PMP describes integration of new missions, products, and services, and includes a table of transition activities.

NOAA/NESDIS/OSPO OSPO/RM-2011-VI .0

OSPO Risk Management Plan

Office of Satellite Product Operations (OSPO) ,.....-,....,.

'"'"'M"""'" '"'"'"' '•'=~ 27, 2011} ,a,i l ' \ ,jJ ~ ·, "l.

~ -,'-r Director

Kathleen A Kelly

Deputy Director (Acting) Mark Moran

MOO Manager Wallops CO/IS Fairbanks COAS Natiooal lco Center SPSO

Ron Mahrnot ~ Manager Manager Manager Manager

- Doug Crawford Larry Ledlow Sharolyn Young Dave Benner

Deputy Deputy Linda Stathoplos

Operations rrt,ornas Renkeveni

- Al McMath

Sat~llite Produc:s Operations Ricky Irving - Joe Pe<ez (Acting)

Support ,- Stephen Howard

Satellite Analysis Support Davida Stree: - Mike Settles Syste111s

- EH~Jir1eer111~1 Bah Cl~rk

Dirac: Services

System~ Ctvis o·eonnors Nva Barnette

: Key -t--------~

: CDAS - Command and Dato Acquisition Station

Er,gineenng : MOO - Missions Operations Division

Cindy H11rnpton : SPSO - Satellite Products ,and Servilles Division I ,..___, __ _,_ - --- - -- .... - .. -..- .. ---- .. __ _._.._...,,__. __ .-..r .. _, __ _._

IT Services

Andre Hammond

Figure 2 - OSPO organizational chart

4.2 OSPO Functional Structure

While OSPO has five divisions, their activities can be grouped into five technical functional areas:

• Command and Control (C&C)

• Data Processing

• Products

• Broadcast Services (External Services)

• Infrastructure Service and Support (Internal Services)

Figure 3 below illustrates the OSPO functional areas within the broader technical structure. Risks should be categorized by these f-tmctional areas to ensure comprehensive risk assessment without undue focus in any one area (see also Section 7).

/"½-

4v <30ES r

-'-POES

Jason ·2

COSqlic-1 ..

m ACE

DMSP-

!ii r,IETO

PA,8

Non-

NOAA

Data Processing

(J

ESPC (0)

Figure 3 - OSPO Functional Areas

4.2.1 Command & Control (C&C)

IOSPOI

Operations

Operational Infrastructure

(J

IMCS

NIC Products

OSPO/RM-2011-Vl .0 Baseline Date: July 2011

OSPO Risk Management Plan

Broadcast Services

SPSD SARSAT

(J Family of Services

(J (J

LRIT A-DCS

(J GEONETCast

Americas

WCDAS

LAN . ••• . .

NSOF

LAN

FCDAS

LAN

(J

C&C manages the 24x7 operations of environmental satellites in support of NOAA's mission, and provides sustaining engineering for the Nation's operational environmental satellites and ground systems. C&C coordinates, prepares, and issues schedules for satellite command, control, and data flow. Personnel of C&C manage operations and maintain the Operations Center, and perform command and control activities for the satellites, health and safety monitoring, anomaly investigation and corrective actions. C&C also provides real-time quality control to monitor all environmental products and services and to ensure their delivery. It configures ground systems and communications networks necessary for satellite command and control, data acquisition and delivery functions.

C&C includes the Wallops Command and Data Acquisition Station (WCDAS), which provides command, telemetry, and environmental data recovery from geosynchronous orbiting and polar-

OSPO Risk Management Plan orbiting satellites managed and operated by NOAA. The primary mission of WCDAS includes the GOES and POES programs. WCDAS also provides support to non-NOAA missions for agencies such as NASA. WCDAS executes spacecraft commands and schedules, acquires, maintains, and distributes a continuous flow of environmental satellite data. It assists in developing emergency procedures to safeguard spacecraft health and safety and executes emergency plans independently in the event of communications outage with OSPO Mission Operations Division.

C&C also includes the Fairbanks Command and Data Acquisition Station (FCDAS), which provides command, telemetry, and environmental data recovery from polar-orbiting and geosynchronous orbiting satellites managed and operated by NOAA. The primary mission of FCDAS includes the POES program, the Air Force Defense Meteorological Satellite Program (DMSP), and contingency support for the GOES west satellite. FCDAS also provides support to non-NOAA missions for agencies such as NASA. FCDAS executes spacecraft commands and schedules and acquires, maintains, and distributes a continuous flow of environmental satellite data. FCDAS assists in developing emergency procedures to safeguard spacecraft health and safety, and executes emergency plans independently in the event of communications outage with OSPO Mission Operations Division.

4.2.2 Data Processing

NOAA's Environmental Satellite Processing Center (ESPC) is a data ingest, processing, and distribution system that converts raw satellite measurements into useful environmental products.

These products are used by NOAA's National Weather Service (NWS), National Ocean Service (NOS), National Marine Fisheries Service (NMFS), Office of Oceanic and Atmospheric Research (OAR), other Federal agencies, state and local governments, and the public to assist in weather forecasting, environmental management, climate analysis, and issuing watches and warnings. ESPC is NOAA's primary data-processing system for the Nation's environmental data, helping to protect U.S. lives and property while enhancing the Nation's environmental, national, homeland, and economic security. (Figure 4)

NOAA/NESDIS/OSPO OSPO/RM-2011-VI .0

OSPO Risk Management Plan

~ GOES 1l (East)

Non,NOAA

POES NOAA 19 (~Mf:"

~~ 1t.TI, ~;;;;;r ~ ;:x_ J Fairbanks Ground Wallops Ground Satellite Operations

Station • POES Station • GOES Control Center

Command and Control

ESPC operational environment

Environmental Satellite Processing Center

Process and Distribute

Data Products

-·:::::::::;> riM - : Customers ]

Archive and Access

(CLASS)

Figure 4 - ESPC process flow in providing satellite products and services

ESPC uses data from NOAA, the Department of Defense, and NASA environmental satellites, as well as foreign and commercial satellites, to provide satellite-derived products and services to national and international customers and users on a 24/7 basis. ESPC ingests and processes data from both Polar Orbiting Environmental Satellites (POES) and Geostationary Operational Environmental Satellites (GOES). Their products enable NOAA to accurately track the location, extent, and duration of severe weather such as hurricanes, tornadoes, and winter storms; support development of flash flood warnings; track volcanic ash clouds and severe winds that threaten aviation safety; detect remote wild fires; monitor coastal ecosystem health; identify and monitor maritime hazards including sea ice, high winds and waves; and assist in search and rescue activities. The value of ESPC lies in its ability to convert raw satellite data into useful products that get delivered to the NWS and other customers within specified time requirements.

The primary functions of ESPC are:

• Ingest data from NOAA satellites and other sources (e.g., non-NOAA satellites)

• Process the data to generate useful products and services

• Distribute the products and services to users

• Support functions (e.g., IT security, scheduling, monitoring, etc.)

The NOAA Center for Applications and Research (ST AR) provides algorithms and applications that ESPC uses for processing satellite data into products, which are then distributed directly to users, and archived at NOAA's Data Centers via the Comprehensive Large Array-data Stewardship System (CLASS). (Figure 5)

Data

Applications and algorithms (STAR) Ancillary Data

I Environmental Satellite :Processing Center (ESPC)

~.s-~~.:.r.~=-s--~ .. ~ . . . Support , ., :

Archive (CLASS)

Figure 5 - Functional roles of ESPC

OSPO/RM-2011-Vl.0 Baseline Date: July 2011

OSPO Risk Management Plan

Products

(Users)

ESPC distributes products to NWS and the Department of Defense, as well as some international users, using the NWS Telecommunications Gateway. For customers without access to the gateway, ESPC provides near-real-time distribution via File Transfer Protocol (FTP) servers.

Data is also available for non-real-time distribution via NOAA's CLASS. OSPO provides over 450 operational products covering Land, Ocean, and Atmosphere, as described in NESDIS' Satellite Product End-to-End Documentation System (SPEEDS). 3 OSPO is working with the NOAA Office of Systems Development (OSD) to develop a common data distribution system capable of supporting distribution not only of existing products, but also of products from future satellite missions with much higher data volumes, such as GOES-R and the Joint Polar Satellite Systems (JPSS). OSPO ESPC processes raw satellite data into useful products and distributes these products to customers within specified time requirements.

Data Processing personnel maintain operational system software applications, network and hardware device drivers and interfaces, data processing to level I B, antenna tracking software, and configuration management. To sustain successfl.il operation, Data Processing personnel perform analysis and provide recommendations to the management team of the Operations Center in the areas of software, computer hardware, and network acquisitions. They direct and monitor Contractor efforts on software maintenance for mission operations.

4.2.3 Products

OSPO provides satellite-derived products and services to national and international customers and users on a 24/7 basis, using data from NOAA, the Department of Defense, and NASA environmental satellites, as well as foreign and commercial satellites. OSPO products and services enable NOAA to accurately track the location, extent, and duration of severe weather including hurricanes, tornadoes, and winter storms. OSPO also provides products that support

3 http://www.ngdc.noaa.gov/speeds

OSPO Risk Management Plan development of flash flood warnings; that track volcanic ash clouds and severe winds that threaten aviation safety; that detect remote wildfires; that monitor coastal ecosystem health; that identify and monitor maritime hazards from sea ice, high winds and waves; and, that assist in search and rescue activities. OSPO is the primary user interface for NOAA's real-time, automated operational environmental satellite products. OSPO leads corrective and adaptive maintenance activities, monitors product quality, and evaluates system performance of product applications. OSPO works with research partners to develop, integrate and implement new science algorithms, technology and dissemination methods from current and future satellites into new operational products. OSPO provides science software test and integration functions for new product applications. OSPO also provides outreach, user education and customer service activities for automated environmental satellite data products.

OSPO produces interpretive analysis products and serves as the primary user interface for NOAA's real-time satellite imagery products and multi-disciplinary environmental analyses.

OSPO schedules and continuously monitors real-time satellite imagery products. OSPO supports hazards mitigation and warning services for U.S. Government agencies, the international community and other users by providing around-the-clock, quality-controlled environmental analyses for decision support applications. OSPO tests, evaluates and validates new interpretive satellite analysis techniques and satellite-derived products to assess their suitability for operational implementation. OSPO provides outreach, user education and customer service activities for interpretive analysis and products.

OSPO provides the primary GOES product applications, which are real-time remapping, interactive products, and automated products. Remapping is the process of mapping imagery data into conventional map projections required by National Weather Service (NWS) field office meteorologists to generate timely and accurate weather forecasts and warnings. The real-time remapping system generates infrared, water vapor, and visible sectors, converting the perspective from the satellite to that of a standard map, (e.g. Mercator) in the process. These sectors are transmitted to the NWS Network Control Facility (NCF) from which they are then broadcast from a commercial communications satellite and are delivered through the NWS network, NOAAPORT, for the Advanced Weather Interactive Processing Systems (AWIPS). Remapped sectors are also used at several of the NWS' National Centers for Environmental Prediction locations. The interactive products function generates and distributes volcanic ash advisories, tropical cyclone intensity, fire and smoke location, ice and snow cover, and precipitation amount products-all requiring interactive human analysis. The automated products function generates cloud drift winds, temperature and moisture profiles, cloud heights, precipitation products, derived product imagery, web images, and imager archive products.

Although the primary uses for NESDIS polar-orbiting satellite products are as inputs to the forecasts and warnings provided by NWS, these satellite data are also used in many other environmental information frameworks by numerous Federal agencies, state governments, and the public and private sector. These uses include analyzing climate change, detecting volcanic eruptions and wilderness fires, as well as tracking associated dust clouds. These satellite data are also used to monitor the health of vegetation, the growth of deserts, and rates of deforestation.

OSPO also ingests and processes data from non-NOAA satellites to create products that support the protection, restoration, and sustainable use of coastal and oceanic ecosystems.

4.2.4 Broadcast Services (External Services)

OSPO/RM-2011-Vl.0 Baseline Date: July 2011

OSPO Risk Management Plan

OSPO manages and is the primary user interface for NOAA's satellite direct broadcast services.

OSPO manages the Search and Rescue Satellite Aided Tracking (SARSA T) system, GOES and Argos Data Collection Systems (DCS) and satellite rebroadcast services of GEONETCast Americas and the Low Rate Information Transmission (LRIT). OSPO provides outreach, user education and customer service activities for environmental satellite broadcast services. SPSD also manages GOES Variable format (GV AR) and POES High Resolution Picture Transmission (HRPT) broadcasts. Both broadcasts provide users with direct real-time access to satellite imagery via fixed or mobile receiving stations.

The Argos DCS is a data collection relay system that adds the benefits of providing global coverage and platform location. The Argos program is administered under a joint agreement between NOAA and the French Space Agency-Centre National d'Etudes Spatiales (CNES).

The Argos DCS consists of in-situ data collection platforms equipped with sensors and transmitters and the Argos instrument aboard NOAA and EUMETSAT polar-orbiting satellites, which orbit earth from north to south to north. The global environmental data sets are collected at telemetry ground stations in Fairbanks, Alaska, Wallops Island, Virginia, and Svalbard, Norway, and are pre-processed by NESDIS in Suitland, Maryland. Two CNES subsidiary companies, Collecte Localisation Satellites (CLS) in Toulouse, France, and CLS America in Largo, Maryland, process the data and deliver it to the end user.

Flying the Argos system aboard polar-orbiting satellites provides worldwide coverage. In addition, incorporating the Argos instrument on a moving satellite allows for locating an in-situ platform using Doppler shift calculations. This positioning capability permits applications, for example, to monitor drifting ocean buoys and to study wildlife migration paths.

The GOES Data Collection System (DCS) is a relay system used to collect information from earth-based platforms. These platforms transmit an electronic signal containing the environmental data observed by the sensors on the platform, at predefined wavelengths and times. These platforms can be placed in remote locations and left to operate with minimal human intervention, unlike traditional sensors which require manual data retrieval. This allows observations from sites that may not be accessible to humans during parts of the year. The transponder on board the satellite detects this signal, and rebroadcasts it so that it can be picked up by the ground equipment at the Wallops Command and Data Acquisition Station (WCDAS).

GOES satellites provide GOES Variable format (GVAR) imagery that are used for the continuous monitoring of the earth's surface to generate the data needed for monitoring and forecasting weather and ocean conditions. GOES satellites are positioned in geosynchronous orbit, which means they orbit above the equatorial plane of the Earth at a speed matching the Earth's rotation, allowing them to hover continuously over one position on the surface. Because they stay above a fixed spot on the surface, they provide a constant vigil for the atmospheric "triggers" that indicate severe weather conditions such as tornadoes, flash floods, hail storms, and hurricanes. The GOES satellites are able to monitor storm development and track their movements when these conditions develop.

OSPO Risk Management Plan

GOES satellite imagery are also used to estimate rainfall during thunderstorms and hurricanes for flash flood warnings, as well as to estimate snowfall accumulations and overall extent of snow cover. Such data help meteorologists issue winter storm warnings and spring snow melt advisories. Satellite sensors also detect ice fields and map the movements of sea and lake ice.

POES satellites provide imagery via direct broadcast Advanced Very High Resolution Picture (AVHRR) that are used to monitor atmospheric, land and ocean conditions on a worldwide basis.

These satellite imagery support specific environmental applications, among which are wildfire detection and mapping, and volcanic ash tracking. Other applications supported by POES satellite imagery monitor sea surface temperature and global vegetation, and track the concentration and drift of sea and lake ice.

GEONETCast Americas is the Western Hemisphere component of GEONETCast, a near-real time, global network of satellite-based data dissemination systems. GEONETCast is designed to distribute space-based, airborne and in-situ data, metadata and products to diverse user communities. Its purpose is to provide global information as a basis for sound decision-making in critical areas including public health, energy, agriculture, weather, water, climate, natural disasters and ecosystems. Accessing and sharing such a range of vital data yields societal benefits through improved human health and well-being, environment management and economic growth.

GEONETCast is led by three regional infrastructure providers: NOAA in the Western Hemisphere (GEONETCast Americas), EUMETSA T in Europe, and the Chinese Meteorological Administration (CMA) in the Asia-Pacific region (FengYunCast). GEONETCast is part of the Group on Earth Observation's contribution to the organization of the Global Earth Observing System of Systems (GEOSS).

The digital Low Rate Information Transmission (LRIT) is an international standard for data transmission that was developed by the Coordination Group for Meteorological Satellites (CGMS) in response to a recommendation on digital meteorological satellite broadcasts. NOAA designed its LRIT system based on the CGMS standard. The NOAA LRIT system provides digital data, via a broadcast service, through its GOES East and GOES West geostationary satellites including both the GOES I-Mand N-P Series. NOAA uses its LRIT broadcast system to disseminate Geostationary Operational Environmental Satellite (GOES) data, GOES Data Collection System (DCS) data, products from the National Weather Service's Emergency Managers Weather Information Network (EMWIN) information and other meteorological products to users.

In response to the loss of a plane carrying two U.S. congressmen over Alaska in 1970-the wreckage of which was never found-the Search and Rescue Satellite Aided Tracking (SARSA T) system was created. SARSA T uses signals from the Emergency Locator Transmitter (EL T) of a downed aircraft, the Emergency Position Indicating Radio Beacons (EPIRB) of vessels in distress, or Personal Locator Beacons (PLBs) to identify the location of emergencies and to communicate with relevant rescue services. The SARSA T system was developed jointly by Canada, France, and the United States. Once operational, SARSAT was turned over to NOAA, where it remains today, operating 24/7, year-round. The system expanded in 1979 to

OSPO Risk Management Plan include the COSPAS (Cosmicheskaya Sistyema Poiska Avariynich Sudov),4 developed in the Soviet Union (now Russia) for similar purposes. The first COSPAS/SARSAT satellite was launched in 1982, and by 1984 the system was fully operational. Now in its 29th year, COSPAS SARSAT has been credited with supporting more than 28,000 rescues worldwide, including more than 6,500 in the United States and its surrounding waters.

4.2.5 Infrastructure Service and Support (Internal Services)

OSPO Infrastructure Service and Support (ISS) includes administration of the local and wide area networks for NSOF, WCDAS, and FCDAS (LAN/WAN), the operational and business essential computers, and supporting equipment. IT support services leads all IT security activities for administered systems. The IT support services team prepares documentation, conducts risk assessments, implements and tests security controls, and performs the system monitoring necessary to accredit and maintain IT systems. They are responsible for all the operations of all Common IT Services (CITS), including administering and maintaining enterprise IT services for NOAA components located in the NSOF through the management of the CITS infrastructure.

OSPO ISS manages terrestrial communication links and monitors environmental compliance and safety of the facilities. OSPO provides facility, ground, and antenna systems maintenance, management, and logistical support for their operation. OSPO performs preventive maintenance, servicing, and systems repair by identifying problem areas and implementing corrective actions to prevent recurrence. OSPO manages facilities in coordination with the General Services Administration and identifies security issues related to the OSPO mission.

4 "Space System for the Search of Vessels in Distress"

OSPO Risk Management Plan

5. FRAMEWORK: RISK MANAGEMENT STRATEGY

5.1 General Strategy

Risks are events or conditions that are not certain to occur, but if they were to occur, they would result in undesirable consequences. Risk management defines a discipline and an environment of proactive decision-making and action for continually assessing possible risks, prioritizing each risk, and implementing strategies to mitigate or eliminate those risks. Risks that are not identified, or not properly· managed, can lead to catastrophic outcomes. By identifying risks in advance, however, and effectively managing them, potential consequences can be anticipated and avoided.

5.2 OSPO Risk Management Plan Benefits

The OSPO RMP will provide the following benefits to OSPO, among others:

• Provide Stakeholder visibility into areas that threaten the overall operations and OSPO's ability to successfully meet its mission

• Provide a mechanism for escalating risks and issues to the OSPO Management Team for support (See Section 6. 4. 10 Risk Reporting and Communication)

• Provide a mechanism to quantify the probability and impact of the risk to the project (See Section 6.4.3 Risk Analysis)

• Identify owners of the actions and plans for mitigation and contingency in order to clarify roles and responsibilities for handling each risk item

• Provide a mechanism to articulate mitigation actions and plans that can help reduce the likelihood of a risk being realized or to minimize its impact (See Section 6. 4. 7 Risk Mitigation Plan)

• Provide a mechanism to articulate the contingency actions and response plans that can be readily executed in the event a risk is realized and becomes an issue (See Section 6. 4. 8 Risk Monitoring, Resolution and Control)

• Provide a mechanism to categorize risks so they can be analyzed for improving future risk management strategies, counter-measures for legacy equipment, and provide lessons learned to future projects (Section 7.3 Risk Classification)

Risk Management is an iterative process that is established when the project begins and is performed continuously until the project ends. It is applied equally to all phases of the project's Iifecycle. The project lifecycle refers to the "Cradle to Grave" approach for a logical sequence of activities to accomplish the project's goals or objectives, while incorporating development tracking for IT refreshes. In addition, since many OSPO activities are operational in nature, risks must also be identified and evaluated for ongoing activities not associated with a specific project.

Risk assessments are made by the OSPO Government Technical Managers (GTM) and OSPO Product Area Leads (PAL), in conjunction with the OSPO Management Team and OSPO Contract Project Managers (CPM), of the probability of an event occurring and what the impact

OSPO Risk Management Plan of that event will be on the project's success. Mitigation plans will be developed for all identified risk events, and contingency plans will be implemented if a risk is realized or the mitigation plan fails. The Risk Management GTM will ensure this approach is followed at the OSPO RMP level.

As discussed in detail in Section 6, risk management is primarily an operational task. Oversight of the OSPO RMP is provided by Corporate Services, including facilitating and approving the creation of divisional-level risk management plans, monitoring the activities of the risk management boards, ~d ensuring that the activities of the risk management boards align with current compliance efforts. Division managers are responsible for ensuring risks are added to the division-level risk register, and visibility is provided at the OSPO risk management board for that division. Division managers must also take responsibility for accurately differentiating risks and issues. Division managers also decide if a risk will be passed to the OSPO RMB for inclusion in their risk management process.

The processes described in this document will provide a framework for the various divisions to manage risks for OSPO as a whole. Risks to specific functional areas should be identified at the division level in accordance with the risk management processes established in this document as well as the functional-area-specific RMPs.

OSPO Risk Management Plan

6. RISK MANAGEMENT PROCESS

6.1 Process introduction

The principles of risk management in the following section reflect current standard practices, but have been tailored to meet the specific needs of OSPO. As mentioned earlier, the OSPO RMP is a roadmap and framework for cost-effective risk management at OSPO. The framework can be adapted to meet the needs and processes of each organization that makes use of it.

The objective of the RMP is to provide a repeatable, transparent, and visible method of risk management that leads to measurable process improvement and improved risk profile. The RMP divides risk management responsibilities among the divisions identified within OSPO (see also Figure 1):

• SPSD

• MOD

• WCDAS

• FCDAS

• NIC

The RMB for each division operates with a high degree of autonomy, but is ultimately accountable to the OSPO RMB, which in tum is accountable to the director. The RMP provides a framework that encourages a free flow of information from project and technical teams to the boards, which in tum communicate with the OSPO RMB. The chairperson of the risk management board for each division will have responsibility for the division risk process (including division risk register), and will exercise discretion in escalating a risk to the level of the OSPO RMB. The RMP structure and process are designed to provide a uniform risk management process for all of OSPO, and to encourage transparency and open communication.

Oversight and ultimate accountability for the implementation and ongoing operation of the RMP · will be exercised by Corporate Services. By monitoring the activities of the various risk management boards, Corporate Services will be responsible to ensure the RMP process is being followed, and that the activities and products of the boards align with relevant compliance initiatives. Managing the RM process for each division is the responsibility of the division manager.

6.2 Roles and Responsibilities

The OSPO Program Team will work together to perform risk management activities. General responsibilities include:

• OSPO System Owners (SO) - Responsible for verification of risk mitigation plans and report to the NESDIS, NOAA and/or DOC authorizing official(s) risks to the OSPO's mission.

OSPO Risk Management Plan

• Division Manager - Overall responsibility for management of all division risk and the division risk management process. All credible IT system risks to OSPO are reported to the System Owner by Division Management.

• OSPO Government Technical Managers (GTM) - Provide approval authority for the management of risks, especially the OSPO Project Managers (PM), including the acceptance of risks that ·cannot be mitigated. Role responsibility includes the identification, analysis, and management of risks, review of risks during scheduled meetings, approval of risk levels, and approval of risk management strategies. The GTMs are responsible for escalating risks to issues; communicating high-level risks and issues to division management and particular the System Owner.

• OSPO Division Information System Security Officer (ISSO) - Develops and monitors compliance with OSPO information security control policies and procedures for the systems within an OSPO division. Ensures users are aware of their responsibilities to protect the system and its information. Serves as approval authority for changes that affect the system access controls. Documents the security controls in the SSP.

• OSPO Management Team - Supports the GTMs in the areas identified above.

• OSPO Contract Project Managers (CPM) - Overall responsibility for identifying, escalating, and managing Product project risks.

• OSPO Product Area Leads (PAL) - Responsible for managing their risks within their assigned satellite product portfolios and reporting on those risks on a monthly basis.

These risks include ensuring effective operations and maintenance support for existing products and challenges associated with new or enhanced product development projects.

• OSPO Team Members - Responsible for risk identification and assistance in assessment and analysis, as necessary.

• Risk Owners - Responsible for analyzing, tracking, and managing assigned risk, and executing any mitigation strategies. The risk owner is the individual on the project team that is closest to the risk event. The risk owner can be an individual or an organization responsible for implementing risk responses or contingency plan.

6.3 Risk Management Tools

The following tools that will be used by OSPO for performing risk management and can be tailored to meet specific Functional Area and Projects needs. Most of these tools are included as MS Word documents or MS Excel spreadsheets in Appendix C.

Monthly Status Report - Each Project-level GTM and PAL reports new risks that have been identified in their monthly status report in the required format and are analyzed during the weekly status meeting for escalation from the division risk register to the OSPO Risk Register.

OSPO Risk Questionnaire - A risk questionnaire will be used annually to identify Risks within

OSPO.

OSPO Plan of Action and Milestones (POAMs) Analysis - A POAM is a plan that describes

NOAA/NESDIS/OS PO OSPO/RM-2011-Vl.0

OSPO Risk Management Plan specific measures to be taken to correct deficiencies found during an assessment of IT security controls. The POAM identifies:

• The tasks needed to correct the deficiency

• The resources required to make the plan work

• Milestones in completing the tasks

• Scheduled completion dates for the milestone

• POAMs Analysis will serve as input of collecting risks related to OSPO and associated mitigation strategies. Prioritization will be based on:

o The categorization impact level of the system o The specific deficiencies that have been found o What potential impact the deficiency can have on the risk exposure of the organization or the ability of the organization to perform its mission o The proposal approach to risk mitigation o Any rationale for accepting some risk level caused by specific deficiencies

OSPO Risk Lists/Risk Register - This tool will be used for identifying, analyzing and managing risks. Its current form is an MS Excel spreadsheet, and can be tracked at the Project, Functional Area, Accredited System, and Product Levels.

Risk Mitigation Plans - The risk mitigation plan (also sometimes referred to as a risk response plan) communicates the way in which specific risks will be dealt with and the action steps that are required to carry them out. It gives team members a clear sense of the actions that they are expected to take and provides management with an understanding of what actions are being taken on their behalf to ameliorate project risk.

Risk Mitigation Status Reports - Identify the Risk Status changes since the last status report.

Risk Status changes includes changes in probability of occurrence or impact. List and describe any new risk event identified during the monthly reporting period.

OSPO Risk Assessment Report - Independent Risk Assessment initially conducted quarterly and then on an as-needed basis by OSPO Corporate Services to evaluate the adequacy of the OSPO systems security. This risk assessment provides a structured qualitative assessment of the operational environment. It addresses sensitivity, threats, vulnerabilities, risks and safeguards.

The assessment recommends cost-effective safeguards to mitigate threats and associated exploitable vulnerabilities.

NESDIS Anomaly Report (Appendix C) - The purpose of this report is to report anomalies to NESDIS; it can be used to extract or report OSPO-specific risks.

Table 6. I describes the OSPO Risk Artifact Deliverable schedule.

Table 6-1 OSPO Risk Artifacts Risk Artifact Format

OSPORisk MS Excel

Register

OSPO Division MS Excel

Risk Register

Project~ Level/Product MS Excel Level B-~lster

Risk/Risk MS Mitigation Status Power Point/ Reports (Monthly) MS Word

MS

Mitigation Status PowerPoint/ Reports (Weekly) MS Word OSPOPOAMs

NIA

Analysi~ OSPO Risk

MS Word Questioni!!l_ire

Risk Mitigation Plans (Monthly)

MS Excel

Risk Mitigation MS Excel

Plans (Weekly) OSPORisk

MS Word Assessmslnt NESDIS…