J-14_-_Policy_-_IT_Management.pdf

DOT Order 1351.39 IT Management Policy

DOT Order 1351.39 Page 1 of 10

CIOP CHAPTER 1351.39 Information Technology (IT) Management Policy

TABLE OF CONTENTS

Section 39.1 Purpose

Section 39.2 Background

Section 39.3 Scope and Applicability

Section 39.4 Policy

Section 39.5 Roles and Responsibilities

Section 39.6 Dates

Section 39.7 Cancellations

Section 39.8 Compliance

Section 39.9 Waivers

Section 39.10 Approval

Appendix A Definition of Terms ................................................................................................................... i

Appendix B Legal Authorities and Guidance .............................................................................................. iii

Section 39.1 Purpose The Department of Transportation (DOT) Information Technology Management Policy serves as the Department-wide authority for effective stewardship of information technology (IT). 1

The policy:

• Defines IT management principles for DOT at all organizational levels;

• Creates a mechanism for how DOT carries out IT management responsibilities established in law and public policy;

• Prioritizes Departmental communication and planning for IT management activities;

• Identifies IT management processes and their alignment with other Departmental processes; and

• Establishes standards and responsibilities for DOT leadership under the IT management stewardship principles.

The requirements of this policy, when enacted, create a foundation for the Departmental IT Management Program.

Table of Contents

1 Per the Clinger-Cohen Act, sections 5002, 5141, and 5142, information technology (IT) is any equipment or interconnected system or subsystem of equipment used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information.

DOT Order 1351.39 Page 2 of 10

Section 39.2 Background DOT’s IT Management Policy goes beyond governance2 to align existing governance activities, information systems, and guidance into a streamlined set of tools to improve the evaluation, selection, prioritization, and implementation of IT investments and services. This policy prioritizes communication and oversight to engage DOT stakeholders throughout the IT investment lifecycle.

To supplement and improve existing requirements for IT selection and oversight, Congress passed the Federal Information Technology Acquisition Reform Act (FITARA) in December 2014 to advance how government agencies approach the acquisition and management of IT systems. FITARA’s main objectives are to:

• Provide better visibility into IT expenditures;

• Improve risk management of IT investments;

• Engage senior DOT officials in the oversight of IT investments; and

• Empower the Departmental Chief Information Officer (CIO) to plan and oversee execution of the Departmental IT acquisition strategy.

Incorporation of the FITARA objectives into DOT IT management standards supports DOT’s goal of providing useful and cost-effective IT investments to the people who need them, when they need them, and in the most appropriate form.

This policy merges existing resource management activities and aligns them with the FITARA framework3 under a set of stewardship principles. Under these principles, IT management at DOT will be:

• Strategically Aligned

• Cost-Effective and Efficient

• Accountable

This policy links the DOT mission, goals, programmatic priorities, and statutory requirements with IT management activities, resulting in increased transparency, accountability, and responsibility. To ensure the effectiveness of this policy, the DOT Office of the Chief Information Officer (OCIO) develops and oversees guidance for IT planning, budgeting and acquisitions, with input from key stakeholders across the organization.

Table of Contents

Section 39.3 Scope and Applicability This policy applies to all DOT Secretarial Offices and Operating Administrations, hereafter referred to as Components. The Office of the Inspector General (OIG) is not a Component as defined in this policy, but may issue internal policies consistent with this policy and may work with the OCIO when consistent with OIG independence.

2 Governance is an ongoing set of activities for selecting IT investments that support and achieve DOT’s mission in a fast-changing IT environment.

3 DOT FITARA Implementation Plan https://www.transportation.gov/sites/dot.gov/files/docs/DOT%20FITARA%20Implementation%20Plan%2C%20December%202015.pdf

DOT Order 1351.39 Page 3 of 10

This policy applies to the Federal Aviation Administration (FAA) only to the extent that such requirements and recommendations are consistent with the language contained in the FAA authorization statutes, FAA General Procurement Authority, and FAA Air Traffic Control Modernization Reviews.4

All organizations acquiring or developing IT investments on DOT’s behalf, including DOT contractors who support, implement or oversee IT activities, are subject to this policy.

Systems acquired by a contractor incidental to a contract, such as contractor-owned timekeeping systems, are not subject to this policy.5

Embedded IT systems are not under OCIO oversight and subsequently are not covered by this policy6. Embedded IT systems are computer systems with a dedicated function within a larger mechanical or electrical system, such as the computer system that enables planes to fly.7

Table of Contents

Section 39.4 Policy The DOT is dedicated to establishing decision-making standards that cover the life of each IT investment and consider associated costs, benefits, and risks. Actively managing DOT’s IT investments improves mission effectiveness and customer service.

Policy statements are grouped per the IT management stewardship principles: Strategically Aligned, Cost-Effective and Efficient, and Accountable. These principles guide activities and goals to ensure thorough, controlled IT management.

Strategically Aligned

Strategic alignment links IT management priorities with DOT’s overall mission strategy and goals. This ensures that IT investments are planned, evaluated and selected to maximize overall Departmental performance.

39.4.1 DOT will plan, evaluate, and select IT investments in support of the agency mission, goals and objectives outlined in the DOT Strategic Plan.

39.4.2 DOT will review and set strategic IT investment priorities based on Federal IT guidance, Departmental CIO IT management planning, and the DOT mission and goals.

39.4.3 DOT will ensure that the OCIO is included in budget, financial, and program management decisions that involve IT investments.

4 49 U.S.C. §§ 106, 40110, 40121 5 Federal Acquisition Regulation Part 39, Acquisition of Information Technology, section 39.204 6 OCIO does maintain an oversight role in how embedded IT interacts with Departmental infrastructure or has implications for cybersecurity.

7 Neutrino Technical Library, Embedded Systems Glossary

DOT Order 1351.39 Page 4 of 10

39.4.4 DOT will recruit, retain, and encourage the continued professional development of a skilled IT management workforce that anticipates and responds to the Department’s strategic IT needs.

Cost-Effective and Efficient

Cost-effective IT management starts in the planning phase to weigh costs and risks against the potential benefit the investment will bring to DOT. Efficient IT management leverages the available people, resources and time to ensure the best possible results from cost-effective investments.

39.4.5 DOT will establish, implement and maintain effective and efficient capital planning and investment control (CPIC) processes for selecting, controlling, and evaluating the results of all major IT investments.8

39.4.6 DOT will include all IT investments in an approved annual IT spend plan that documents all anticipated obligations and expenditures, as overseen by the Departmental CIO.

39.4.7 DOT will manage IT investments as consolidated portfolios with an emphasis on minimizing duplication, achieving efficiencies, maximizing performance, and increasing use of shared-service delivery models.

39.4.7.1 DOT shall consider government-wide shared services consistent with government-wide policy.

39.4.7.2 DOT IT Shared Services (ITSS) is the de facto shared services provider for the Department.9

39.4.7.3 Components may offer shared-services with the approval of the DOT CIO.

39.4.8 DOT will establish and implement measurement standards for determining the net benefits and risks of an IT investment.

39.4.9 DOT will use standardized cost savings and cost avoidance metrics and performance indicators for IT acquisitions and investments.

39.4.10 DOT will maintain a current and complete inventory of the agency and Component IT investments that accounts for regular hardware, software and product lifecycle refreshment.

Accountable

Accountability for IT management depends on the relationships developed between leadership and stakeholders across the organization. Two-way communication encourages open exchange

8 A major IT investment is one requiring special management attention because of its importance to the mission or function of the government; significant program or policy implications; high executive visibility; high development, operating, or maintenance costs; unusual funding mechanism; or definition as major by the agency’s capital planning and investment control process.

9 See the Common Operating Environment (COE) Shared Services Policy for details about evaluating and ruling out ITSS-provided services before seeking alternative IT systems or solutions.

https://www.transportation.gov/digitalstrategy/policyarchive/Common-Operating-Environment-Shared-Services-Policy

DOT Order 1351.39 Page 5 of 10 of information about the performance of IT investments, gaps in IT coverage that have yet to be filled, and the balance of acquisition priorities for IT and DOT as a whole.

39.4.11 DOT will establish IT management standards and tools to ensure that IT investments are overseen at the appropriate organizational level.

39.4.11.1 Department-level standards will support and promote enterprise solutions.

39.4.11.2 Component-level standards will guide Component responsibilities for managing and overseeing their portfolios and mission-specific systems.

39.4.12 DOT will establish IT Management Oversight Mechanisms to develop and implement strategic plans and processes that respond to changing IT needs and performance. Mechanisms will be established for the Department and for each Component, and membership will be decided by the appropriate leadership at each level. The mechanisms will:

• Set priorities among IT investments;

• Link IT investments to mission needs;

• Identify opportunities to minimize duplicative information systems;

• Assess performance data to determine the current maturity of the IT portfolio management processes;

• Monitor and evaluate IT investments to ensure that they deliver value within budget and schedule constraints;

• Evaluate system requirements and anticipate critical problems in an investment; and

• Revise or terminate underperforming investments.

39.4.13 DOT will report the status of IT investments and demonstrate how each investment is needed to meet the agency's operational needs and strategic goals and mission.

39.4.13.1 DOT will take corrective action to correct any deficiencies in reported data.

39.4.13.2 DOT will provide status updates on deficient IT initiatives or investments until the deficiency is resolved.

Table of Contents

Section 39.5 Roles and Responsibilities This section defines the roles key to implementing the Departmental IT Management Policy.

Provided below is a listing of the roles and the levels in the organization in which they reside.

The Departmental Associate Chief Information Officer for IT Policy and Oversight is the designated responsible official for maintaining and ensuring the execution of this policy.

Department Level

• Departmental Chief Information Officer

• Departmental Associate Chief Information Officer for IT Policy Oversight

• Departmental Chief Financial Officer

• Office of the Senior Procurement Executive

DOT Order 1351.39 Page 6 of 10

Component Level

• Component Chief Information Officer

• Component Chief Financial Officer

• Component Chief Acquisitions Officer

Program Level

• Business Owner

• System Owner

Department Level

39.5.1 Accountability for directing DOT’s IT Management, and for all IT functions, resides with the DOT Chief Information Officer (CIO). In addition to responsibilities listed elsewhere in Departmental regulations and policy, the DOT CIO will:

39.5.1.1 Ensure a Departmental IT Management Program is developed, documented, implemented and promoted to support IT management activities for all information systems that support Departmental operations.

39.5.1.1.1 Delegate appropriate authority to the Associate CIO of IT Policy and Oversight to assist with implementation, evaluation and administration issues surrounding IT management and related applicable legislation.

39.5.1.2 Provide oversight of Component-level IT management programs to ensure Component CIOs use IT management policies and processes that are appropriate for their specific portfolios and investments.

39.5.1.3 Ensure IT management processes are integrated with DOT strategic and operational planning processes.

39.5.1.4 Provide resources to administer the Departmental IT Management Program.

39.5.2 Implementation, oversight and advocacy of the Departmental IT Management Program is delegated to the Office of IT Policy and Oversight. The Departmental Associate Chief Information Officer for IT Policy Oversight (ACIO) will:

39.5.2.1 Ensure the DOT establishes and implements IT management processes, including full compliance with Federal laws, regulations and policies.

39.5.2.2 Establish a CPIC process to ensure the IT management stewardship principles are followed by all IT investments.

39.5.2.3 Design and implement a process for maximizing value and managing risks of DOT’s IT investments.

39.5.2.4 Participate in Component investment review meetings as a voting member to ensure that planned IT investments are delivering end-user value and meeting mission objectives.

39.5.2.5 Maintain an up-to-date inventory of all information technology investments, including data on cost, schedule, performance, risk categorization, and any other level of detail appropriate for overseeing and managing IT investments.

DOT Order 1351.39 Page 7 of 10

39.5.2.6 Work with the Chief Financial Officer (CFO) and Senior Procurement Executive (SPE) to integrate the IT Management Policy and processes with budget and financial management decisions at DOT.

39.5.2.7 Participate in Department-wide budget and acquisition development activities for programs that include IT investments or address IT management priorities.

39.5.2.8 Ensure that DOT meets all internally and externally mandated reporting deadlines for IT management benchmarks and performance measurements.

39.5.2.9 Ensure that the appropriate leadership official or governing board reviews and approves IT investments and service contracts or agreements.

39.5.2.10 Develop and implement appropriate strategies for hiring and professional development of IT management personnel.

39.5.3 The Departmental Chief Financial Officer (CFO) has express IT management authorities under the Chief Financial Officers Act of 199010, and is responsible for providing sound budget development, rigorous financial management, and responsible credit administration for the Department. The CFO will:

39.5.3.1 Facilitate the effective management and oversight of IT investments by ensuring they are identified and separated from non-IT investments during the budgeting process.

39.5.3.2 Work with the OCIO to integrate the IT management policy and processes with budget and financial management policies and processes at DOT.

39.5.3.3 Assist the Departmental CIO and Component offices in the analysis and assessment of all DOT mission systems before authorizing investments in new or changed information technology, or retirement of outdated technology.

39.5.4 The Departmental Senior Procurement Executive (SPE) facilitates the accomplishment of DOT's mission by providing policies, practices and services regarding acquisition, financial assistance management and competitive sourcing. The SPE will:

39.5.4.1 Partner with the Departmental CIO to develop and implement DOT-specific IT management-related contract clauses for incorporation in all current and future contracts and covered grants, as well as promote the use of such clauses.

39.5.4.2 Include appropriate IT management requirements in all contracts and other acquisition-related documents for DOT information systems developed, maintained, operated, or managed by contractors.

Component Level

39.5.5 Accountability for directing the Component-level IT management and portfolio oversight resides with the Component CIO. In addition to responsibilities listed elsewhere in Departmental policy, the Component CIO will:

39.5.5.1 Implement the IT management process to ensure the stewardship principles are followed by all investments.

10 Chief Financial Officers Act of 1990 http://govinfo.library.unt.edu/npr/library/misc/cfo.html

DOT Order 1351.39 Page 8 of 10

39.5.5.2 Incorporate the IT management policies, processes and reporting standards established by the OCIO into IT portfolios and investments.

39.5.5.3 Contribute Component IT investment inventory data to the overall DOT portfolio inventory.

39.5.5.4 Lead regularly scheduled investment review activities to ensure that Component IT investments are delivering end-user value and meeting their mission objectives.

39.5.5.5 Participate in OCIO-led budget and acquisition development activities that include IT investments or address IT priorities.

39.5.5.6 Meet all internally and externally mandated reporting deadlines for IT management benchmarks and performance measurements.

39.5.5.7 Work with procurement officials to ensure that all contracts or agreements for IT or IT services are reviewed and approved by the appropriate leadership official or governing board.

39.5.5.8 Ensure that the Component IT program is staffed with IT professionals who meet hiring and training requirements established by the DOT CIO.

39.5.6 The Component Chief Financial Officer (Component CFO) is responsible for providing sound budget development, rigorous financial management, and responsible credit administration for the Component. The Component CFO will:

39.5.6.1 Facilitate the effective management and oversight of IT investments by ensuring they are identified and separated from non-IT investments during the budgeting process.

39.5.6.2 Work with the Component CIO to integrate the IT management policy and processes with budget and financial management policies and processes at the Component.

39.5.7 The Component Chief Acquisitions Officer (Component CAO) facilitates the accomplishment of Component missions by providing policies, practices and services regarding acquisition, financial assistance management and competitive sourcing. The Component CAO will:

39.5.7.1 Partner with the Component CIO to develop and implement Component-specific IT management-related contract clauses for incorporation in all current and future contracts and covered grants, and promote their use.

39.5.7.2 Include appropriate IT management requirements in all contracts and other acquisition-related documents for Component information systems developed, maintained, operated, or managed by contractors.

Program Level

While the roles of Business Owner and System Owner are separate and distinct, the same individual may fulfill both roles for an investment, initiative, or program.

39.5.8 A Business Owner is the accountable executive sponsor, champion, and owner of the requirements for the service, activity, or information system. The Business Owner will:

39.5.8.1 Leverage IT management processes to provide the Component CIO with regular updates on the cost, schedule, and overall performance variances of IT projects.

DOT Order 1351.39 Page 9 of 10

39.5.8.2 Ensure that business requirements are known and that IT investments are meeting those requirements to deliver customer value.

39.5.9 The System Owner is the key point of contact (POC) for the information system and is responsible for coordinating System Development Life Cycle activities specific to the information system. The System Owner will:

39.5.9.1 Incorporate DOT and Component guidance for IT management functions into the design, development, and implementation of information systems.

39.5.9.2 Ensure technology development meets acquisition needs to deliver customer value.

Table of Contents

Section 39.6 Dates

39.6.1 The effective date of this policy is the date the policy is signed.

39.6.1.1 The policy is effective immediately for all new systems. Existing and/or legacy systems have one year from signature to comply with policy requirements.

39.6.2 In accordance with the CIOP and the DOT Order Directive Process, this chapter will be reviewed annually and validated by the DOT CIO. The policy content will be annually reviewed to ensure it has clear intent, contains the correct material and complies with the IT Directive Publication Process.

Table of Contents

Section 39.7 Cancellations

39.7.1 This policy supersedes the following previously issued policy and guidance:

• CIOP Chapter 1351.39, dated August 29, 2012 Table of Contents

Section 39.8 Compliance

39.8.1. Compliance with this policy is mandatory.

39.8.2. This policy does not supersede any other applicable law, higher-level Departmental policy, or existing labor management agreement in place as of the effective date of this policy.

39.8.3. The OCIO will conduct periodic evaluations of this policy and of IT Management Programs throughout the Department to ensure compliance with this policy.

Table of Contents

Section 39.9 Waivers

39.9.1. The DOT Components may request that the DOT CIO grant a waiver of compliance based on a compelling business reason. In addition to an explanation of the waiver sought, the request must include: (1) justification (2) what measures have been implemented to ensure that

DOT Order 1351.39 Page 10 of 10

IT management principles have been implemented (3) waiver period and (4) milestones to achieve compliance. The DOT CIO will provide a written waiver or justification for denial.

Section 39.10 Approval

Kristen Baldwin Acting Departmental Chief Information Officer

DOT Order 1351.39 Page i of iii

Appendix A: Definition of Terms

Capital Planning and Investment Control (CPIC): A process for maximizing the value and assessing and managing the risks of the information technology acquisitions of the executive agency to:

1. Provide for the selection of information technology investments to be made by the executive agency, the management of such investments, and the evaluation of the results of such investments;

2. Be integrated with the processes for making budget, financial, and program management decisions within the executive agency;

3. Include minimum criteria to be applied in considering whether to undertake an investment in information systems, including criteria related to the quantitatively expressed projected net, risk-adjusted return on investment and specific quantitative and qualitative criteria for comparing and prioritizing alternative information systems investment projects;

4. Provide for identifying information systems investments that would result in shared benefits or costs for other Federal agencies or State or local governments;

5. Provide for identifying for a proposed investment quantifiable measurements for determining the net benefits and risks of the investment; and

6. Provide the means for senior management personnel of the executive agency to obtain timely information regarding the progress of an investment in an information system, including a system of milestones for measuring progress, on an independently verifiable basis, in terms of cost, capability of the system to meet specified requirements, timeliness, and quality. (Source: Clinger Cohen Act of 1996)

Common Operating Environment (COE): Departmental shared services are provided in a Common Operating Environment (COE) and managed by IT Shared Services (ITSS), a fee-for-service organization within the Office of the Secretary. COE customers are Departmental Operating Administrations and Secretarial Offices that pay according to Working Capital Fund (WCF)-established billing methodologies to leverage these services. (Source: U.S. Department of Transportation Services Management Policy)

Information System: A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. (Source:

NIST SP 800-53 Rev. 4, Recommended Security Controls for Federal Information Systems)

Information Technology: Any equipment or interconnected system or subsystem of equipment used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission or reception of data or information by the executive agency; equipment used by the executive agency directly or by a contractor under a contract with the executive agency that requires the use – (i) of that equipment; or (ii) of that equipment to a

DOT Order 1351.39 Page ii of iii significant extent in the performance of a service or the furnishing of a product. (Source: Clinger Cohen Act of 1996)

Information Technology Investment: An expenditure of information technology resources to address mission delivery and management support. This may include a project or projects for the development, modernization, enhancement, or maintenance of a single information technology asset or group of information technology assets with related functionality, and the subsequent operation of those assets in a production environment. These investments shall have a defined life cycle with start and end dates, with the end date representing the end of the currently estimated useful life of the investment, consistent with the investment’s most current alternatives analysis if applicable. (Source: OMB Circular A-130, Revised July 28, 2016: Managing Information as a Strategic Resource) Shared Service: An information technology function that is provided for consumption by multiple organizations within or between Federal Agencies. There are three general categories of IT shared services: commodity, support, and mission; which are delivered through cloud-based or legacy infrastructures. Federal Agencies establish and deliver intra-agency IT shared services, which are often overseen by the agency’s CIO. Inter-agency IT shared services are called Lines of Business (LOBs) and are operated by a Managing Partner within a Federal Agency, after approval by OMB. (Source: Federal IT Shared Services Strategy, May 2, 2012)

DOT Order 1351.39 Page iii of iii

Appendix B: Legal Authorities and Guidance

Legislation

• Chief Financial Officers Act of 1990

• The Clinger-Cohen Act of 1996

• E-Government Act of 2002, P.L. 107-347

• Federal Acquisition Regulation (FAR)

• Federal Acquisition Streamlining Act

• Federal Information Security Management Act, P.L. 107-347, Title III

• Federal Information Technology Acquisition Reform Act (FITARA)

• Government Paperwork Elimination Act, P.L. 105-277, Title XVII

• GPRA Modernization Act of 2010

• Program Management Improvement and Accountability Act

• The Paperwork Reduction Act of 1995, as amended, 44 U.S.C. 3501, et seq.

National Policy, Directives and Memoranda

• OMB Memorandum M-15-14: Management and Oversight of Federal Information Technology

• OMB Memorandum M-17-22: Comprehensive Plan for Reforming the Federal Government and Reducing the Federal Civilian Workforce

• OMB Circular A-130, Revised July 28, 2016: Managing Information as a Strategic Resource

• OMB Circular A-11, Section 55: Information Technology Investments

• Federal IT Shared Services Strategy, May 2, 2012

DOT Policies

• U.S. Department of Transportation IT Directives Management Policy (DOT Order 1351.1)

• Transportation Acquisition Regulation (TAR)