J-4_-_Definition_of_Terms_and_Acronyms_Final.pdf

U.S. Department of Transportation

Office of the Chief Information Officer

(OCIO) Acquisition

Attachment Definition of Terms and Acronyms

August 2018

Attachment Definitions of Terms and Acronyms

DEFINITIONS

In the event of a conflict between the Definitions set forth in this attachment and a Definition contained within one of the OCIO EITSS Performance Work Statements (PWSs), the Definition in the PWS shall prevail.

TERM DEFINITION

Abandoned Call A call during which a caller selects an option from the Voice Response Unit and hangs up the call prior to the call being answered by a Customer Service

Representative.

Application

Hosting Services

Used to convey the scope of services supporting customers by hosting applications on physical and virtualized application servers within the Contractor’s facilities and includes co-location of Government-furnished equipment in the Contractor’s facilities.

Associate

Contractor

Agreement

(ACA)

An agreement between contractors working on separate government contracts requiring joint participation to successfully accomplish and fulfill the government’s requirement. The ACA includes the basis for sharing information, data, technical knowledge, expertise, and/or resources essential to the integration of service delivery to ensure the greatest degree of cooperation for the development of the program to meet the terms of the contract.

Business Days Monday through Friday, excluding Federal holidays.

Change In an operational context, an addition, modification or deletion to the approved, supported or base-lined assets (i.e., network equipment, software and supported applications, processes, end user devices, associated documentation, and

Contractor assets relating thereto). Changes may arise reactively in response to incidents/problems or externally imposed requirements (e.g., legislative changes), or proactively from attempts to (a) seek greater efficiency or effectiveness in the provision or delivery of services; (b) reflect business initiatives; or (c) implement programs, projects or service improvement initiatives. Changes must be approved by the government, through the Change Management process, prior to implementation.

Change Control Managing change processes involving hardware, communications equipment and software, system software, 'live' application software and all documentation and procedures associated with the running, support and maintenance of live systems.

Change

Management

In an operational context, the government-approved processes and procedures necessary to manage changes to the infrastructure, all assets within the environment, or other operational aspects of the services with the goal of enabling government-approved changes with minimum disruption to service delivery. Change

Management attempts to ensure efficient and prompt handling of all changes to minimize the impact of any change upon services. Change Management processes and procedures generally include creating change ticket/record/request, assessing the impact, costs, benefits, and risks of proposed changes, developing business justifications for changes, and obtaining government approval to such change prior t o implementation; managing and coordinating change implementation; and reviewing, reporting, and closing change tickets/records/requests.

Contact

A unique incident or service request received by the Service Desk via telephone, voicemail, web form, web chat, and/or email, involving a separate individual event that results in opening, respectively, a Service Desk ticket. For incidents where multiple contacts are related to a single point of failure (e.g., contacts related to a server outage), such contacts will be considered a single Incident, will not result in opening a separate Service Desk ticket and will not be aggregated or counted as

TERM DEFINITION

individual contacts for measuring contact volume statistics.

Contracting

Officer (CO)

A designated government official with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

Contracting

Officer’s

Representative

(COR)

An authorized representative of the Contracting Officer acting within the limits of his or her authority as delegated by the Contracting Officer.

Customer

Service Request

(CSR)

A request for the performance of work that is not being performed at a particular time but that is within the scope of the services.

Confidential

Information (CI)

Refers to information or data of a personal nature about an individual, or proprietary information or data submitted by or pertaining to an institution or organization or the government. See also Sensitive Data/Information.

Controlled

Unclassified

Information (CUI)

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies but is not classified.

Dashboard A management and reporting tool used to visually present information to ascertain the ongoing status (i.e., “health”) and performance of various IT elements or business enterprise operations via key business and technical indicators.

Disaster Any sudden, unplanned, calamitous event causing great damage or loss as defined or determined by a risk assessment and business impact analysis, and which c r e a t e s an inability on the organization's part to provide critical business functions for some predetermined period of time. A disaster also includes any period when the government decides to divert resources from normal production responses and exercises its disaster recovery plan.

Disaster

Recovery (DR)

The process, and related activities, required to restore the government’s IT environment to an acceptable condition of normal business operation following declaration of a disaster.

Defect A flaw in a solution or component that causes the solution or component to fail to perform its required function.

Defect Priority Priority defines the order in which a defect should be resolved. In other words, do we fix it now, or can it wait? The higher the priority, the more urgent it is for the project team to fix the defect.

Defect Priority

Categories

• Priority 1 (Critical): The defect must be resolved as soon as possible because the defect prevents a user from using or entering information into the application. The solution cannot be used until the repair has been implemented.

• Priority 2 (High): The defect must be resolved as soon as practical after all

Critical Priority defects have been resolved. The defect causes issues with one or more parts of the solution and prevents a user from obtaining reliable information from the solution. The solution can be used, but it is degraded.

Desktop

Virtualization

Refers to the processes and technology solution deployed to run a user desktop inside a virtual machine that resides on a server.

End User A person, organization, or other entity that consumes IT-related services provided under a Task Order and the resulting Contract.

End user Device A unit of computing hardware, and its associated standard software image that is used and interacted with by an end user, including both stationary, mobile, and hand-held computing components. An end user device may be a desktop, laptop, tablet computer, mobile phone, wearable, etc., as well as the associated peripheral components interconnected electronically via wired or wireless connectivity, including keyboards, mice, monitors, hard drives, CD-ROM players, speakers, microphones, printers (network-attached and locally attached), multifunctional devices, scanners, and other end user hardware units.

Endpoint Device An Internet-capable computer hardware device operated by a user that is connected

(via cable or wireless connection) to a Local Area Network (LAN) or Wide Area

Network (WAN) and accepts communications back and forth across the network.

Endpoint devices include, but are not limited to, desktop computers, laptop computers, thin client computers, and mobile devices (e.g., mobile phone, tablet, wearable).

Endpoint Image

Core Software

The suite of software programs used to build a HHS-defined standard endpoint image for a supported device (e.g., operating system or O/S, software, office productivity and messaging software, security tools, and remote connectivity software).

Failover The capability to switch over automatically to a redundant or standby computer server, system or network upon the failure or abnormal termination of the previously active server, system or network.

Foreign National An alien, i.e., any person who is not a citizen of the United States or any person who was born outside the jurisdiction of the United States, is a citizen of a foreign country, and has not become a naturalized U.S. citizen under U.S. law. This includes legal permanent residents/lawful permanent residents (LPR), also known as permanent resident aliens, resident alien permit holder, and green card holder

( 22 U.S.C. § 6023(8) ) and 8 U.S.C. § 1101(a)(3) .

Hold Harmless To relieve from responsibility or liability for any damage or loss.

IMAC Activities performed as pre-scheduled events to install, remove, relocate, upgrade or otherwise reconfigure a computing system and/or telecommunications infrastructure component(s).

Incident An unplanned interruption to an IT Service or reduction in the quality of an IT service. Failure of a configuration item that has not yet affected service is also an incident - for example, failure of one disk from a mirror set.

Incident

Resolution

The point at which the Contractor has responded to an Incident and the Contractor has either (a) successfully diagnosed and taken appropriate corrective actions to return the systems(s) or service(s) to an acceptable level of operability and performance for the government to conduct business or (b) has provided an appropriate answer to an inquiry or an informational question that is understood by and acceptable to the government. In both cases, the incident is not resolved until government is convinced and satisfied that it has been resolved.

Local Time The time at the location where the service is being provided. If the location observes

Daylight Savings Time, local time will adjust accordingly.

Location Any present or future site at which the government client conducts operations, including offices and facilities.

Logical Access Access to a federal information system that requires the Contractor (and/or any subcontractor) to logon with a HHS Windows Active Directory account or some other

HHS authorized network operating system account. The term “logical access” does not include access to a public web site, whether by an HHS Contractor or member of the public, because such web sites do not require permission to access. In the case of sensitive data/information that exists in hard copy, “access” means providing a

Contractor (and/or any subcontractor) the right to view or use written/typed data or information for the purpose described in a contract.

Milestone A point in a project plan when completion of a significant component or module is to be completed.

Network

The equipment and software, cabling infrastructure, and the telecommunications circuits providing the physical and logical interconnectivity (both wired and wireless) between multiple computing devices. The Network includes the local area network

(LAN), wide area network (WAN), virtual private network (VPN), wireless local area network and interconnecting devices.

Non-Public

Information

Refers to information only to be used by authorized individuals including authorized contractors. As the term clearly implies, non-public information is not releasable to the public.

OA A Department of Transportation Operating Administration.

Problem A cause of one or more Incidents. The cause is not usually known at the time a

Problem Record is created, and the Problem Management Process is responsible for further investigation.

Personally

Identifiable

Information (PII)

Any information about an individual including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.

Physical Access Physical entry to and/or exit from a federally controlled facility.

Re-opened

Ticket

A Re-Opened Ticket is defined as one where the ticket was re-opened within four business days or less after the ticket was originally closed/resolved. To be categorized as a “Re-opened Ticket” the end user must be experiencing the same incident as was resolved on the closed ticket.

Refresh or

Technology

Refresh

The replacement of identified existing assets with newly procured assets in accordance with an in-scope service request and OCIO procedures.

Root Cause

Analysis

A problem management analysis process used in determining and documenting the unknown underlying cause(s) of one or more incidents and ensuring that appropriate actions are taken to correct the situation to minimize the possibility of recurrence of the incident(s) or events. It is also used as a predictive process in identifying and analyzing trends that could result in the future occurrence of one of more incidents.

Routine Access Access that is on a regular, non-intermittent basis, which is at least once per week during the contract or order period of performance.

Self-Help

Support

Refers to automated/electronic means made available directly to end users to assist in fulfilling various service requests not requiring personal assistance, including end user’s ability to track Service Desk trouble ticket status and enter service requests without calling the Service Desk.

Sensitive Data /

Information

Defined in the Departmental Standard for the Definition of Sensitive Information (see latest revision http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/HM/dept_standard_for_d ef_of_sens_info-051809.pdf ) .

Service Desk The Contractor’s location with skilled Service Desk staff available to personally answer calls and provide Service Desk support to end users.

Service Request An end user request for delivery of pre-defined, standard services, for which a pre-defined approval and qualification process exists. Response to a service request is usually something that can be planned and is not considered an Incident, which is an unintentional, unplanned service disruption. Service requests may include, but are not limited to, requests for (i) information about services or procedures; (ii) procuring and installing new hardware or software; (iii) making a move, add or change to existing hardware or software; or (iv) making an enhancement to an existing application or for new application development.

Priority Level Priority defines the order in which a defect should be resolved.

Service Level

Agreement (SLA)

An agreement that sets the expectations between the service provider and the customer and describes the products or services to be delivered, the single point of contact for end-user problems and the metrics by which the effectiveness of the http://intranet.hhs.gov/it/cybersecurity/docs/policies_guides/HM/dept_standard_for_d process is monitored and approved.

Service Level

Objective (SLO)

Within service–level agreements (SLAs), SLOs are the objectives that must be achieved — for each service activity, function and process — to provide the best opportunity for customer success.

Service

Management

System

An application or suite of applications providing some combination of incident, problem and ticket management, asset management and discovery, change and configuration management, knowledge management, service level management capabilities, and a common configuration management database.

Service Request User request for information or advice, or for a standard change (a pre-approved change that is low risk, relatively common and follows a procedure) or for access to an IT service.

Severity Level 1

(Emergency /

Urgent - Critical

Business Impact)

The Incident has caused a complete and immediate work stoppage affecting a

Critical Function or Critical Infrastructure component such that a primary business process or a broad group of users such as an entire department, floor, branch, line of business, or external customer. No work around is available. Examples: Email outage; WAN or LAN outage; Security violation (e.g., denial of service, port scanning)

Severity Level 2

(High - Major

Business Impact)

A business process is affected in such a way that business functions are severely degraded, multiple users are impacted, a key customer is affected, or a Critical

Function is operating a significantly reduced capacity or functionality. A Workaround may be available; however, the Workaround is not easily sustainable. Examples:

Major data/database or application problem (e.g., email gateways/internet mail flow)

E-mail system is performing slowly, but workload in manageable.

Severity Level 3

(Medium -

Minimal

Business Impact)

A business process is affected in such a way that certain functions are unavailable to end users or a system and/or service is degraded. A Workaround may be available. Examples: Telecommunication problem (e.g. Blackberry, PBX digital/analog card) End-User Device problem (e.g., hardware, software), or a problem that may keep repeating and affecting just a user at a time.

Severity Level 4

(Low - Minimal

Business Impact)

An Incident that has little impacts on normal business processes and can be handled on a scheduled basis. A Workaround is available or there is minimal negative impact on a user’s ability to perform their normal daily work. Example:

“How To” questions Service Requests (e.g., system enhancement, changes installations) Preventive Maintenance.

Specification(s) The functional and technical requirements of a solution, which are codified in a document that clearly describes the essential items, materials, or services, functions, features and/or operational processes needed to fulfill HHS delivery criteria including the criteria for determining that requirements have been met.

Task Order An order placed for services by the CO in accordance with the terms and conditions of the contract.

Third Party A person or entity other than the parties bound by a contract.

Ticket A unique logical electronic record the Service Desk contractor will create, update, manage, and archive for each incident. A ticket is used to record all end user to service desk contractor interactions pertaining to an incident or service request and all service desk contractor-related actions and escalations, and corresponding date/time, taken to resolve an incident or service request, from the time it is first reported to the Service Desk until incident or service request resolution time and closure by the Service Desk. Also, it is used for application change-control traceability.

Tier 0

Self-help support that does not require the involvement of a technician. The user is able, through provided tools, to resolve the issue without human intervention.

Tier 1/1B Receives inbound requests through various channels and performs triage to determine the optimal queue for resolution of the issue. Places the inquiry in the appropriate queue. Tier 1B will perform additional triage and follow-up with customer where needed Tier 2 Performs basic troubleshooting and remediation of the request or issue. Addresses basic technical and non-technical requests. Consults with Tier 3 personnel to resolve issues when necessary.

Tier 3 Perform advanced troubleshooting and resolution when the incident or problem is beyond the capabilities of the Tier 2 personnel. Consults with Tier 4 personnel to resolve issues when necessary.

Tier 4 Support provided by original equipment manufacturers and software vendors typically for highly complex issues.

Workaround A temporary solution that the Contractor or government can implement in the event of an Incident as an alternate method of providing full service or process functionality that allows the affected system(s) and/or process(es) to deliver an acceptable level of business operations functionality to the government until a permanent incident resolution can be implemented. Any such workaround must be acceptable to and approved by the government.

ACRONYMS

ACRONYM DEFINITION

AAR After Action Report

ACA Associate Contractor Agreement

ACD Automated Call Director

ACL Access Control List

ANACI Access National Agency Check, Inquiries

AOR Assumption of Responsibility

API Application Program Interface

AQL Acceptable Quality Level

ASA Assistant Secretary for Administration

ASFR Office of the Assistant Secretary for Financial Resources

ATO Authority to Operate

BI Background Investigation

BOE Basis of Estimate

BOM Bill of Materials

C&A Certification & Accreditation

CCB Change Control Board

CDM Continuous Diagnostics and Mitigation

CFR Code of Federal Regulations

CIO Chief Information Officer

CIS Center for Information Security

CISO Chief Information Security Officer

CLIN Contract Line Item Number

CMP Continuous Monitoring Plan

CO Contracting Officer

COB Close of Business

COCO Contractor Owned, Contractor Operated

CONOPs Concept of Operations

CONUS Contiguous United States

COOP Continuity of Operations Planning

COR Contracting Officers Representative

COTS Commercial Off The Shelf

CP Contingency Plan

CPARS Contractor Performance Assessment Reporting System

CPU Central Processing Unit

CR Change Request

SOC Security Operations Center

CSP Cloud Service Provider

CSR Customer Service Request

CUI Controlled Unclassified Information

CVSS Common Vulnerability Scoring System

DA Division of Acquisition

DBMS Database Management System

DHCP Dynamic Host Configuration Protocol

DISA Defense Information Systems Agency

DKIM Domain Keys Identified Mail

DMZ Demilitarized Zone

DNS Domain Name Service

DR Disaster Recovery

DUNS Data Universal Numbering System

EFT Electronic Funds Transfer

EIT Electronic and Information Technology

EPLC Enterprise Performance Life Cycle

ETL Extract, Transform, and Load

FAR Federal Acquisition Regulations

FDCC Federal Desktop Core Configuration

FedRAMP Federal Risk and Authorization Management Program

FFP Firm Fixed Price

FIPS Federal Information Processing Standards

FISMA Federal Information Security Modernization Act

FMS Financial Management Service

FOUO For Official Use Only

FOSS Free Open Source Software

FSC Forward Schedule of Changes

FTR Federal Travel Regulation

FY Fiscal Year

GB Gigabyte

GFE Government Furnished Equipment

GFI Government Furnished Information

GFM Government Furnished Materials

GOCO Government Owned, Contractor Operated

GOTS Government Off the Shelf

GUI Graphical User Interface

HHS U.S. Department of Health and Human Services

DOTAR DOT Acquisition Regulations

DOTNet Department of Transportation Network

HIDS Host-Based Intrusion Detection System

HIPAA Health Insurance Portability and Accountability Act

HSPD Homeland Security Presidential Directive

HVAC Heating, Ventilation and Air Conditioning

IA Information Assurance

IAM Identity and Access Management

IAW In Accordance With

ID Identification

IDIQ Indefinite Delivery, Indefinite Quantity

IDS Intrusion Detection System

IM&P Instant Messaging & Presence

IMAC Install, Move, Add, Change

IMS Integrated Master Schedule

IP Internet Protocol

IPS Intrusion Protection System

IPT Integrated Product Team

ISCM Information Security Continuous Monitoring

IS2P Information Systems Security and Privacy Policy

ISDN Integrated Services Digital Network

ISSO Information Systems Security Officer

IT Information Technology

ITIL IT Infrastructure Library

OCIO Office of the Chief Information Officer

IV&V Independent Verification and Validation

KMS Knowledge Management System

KPI Key Performance Indicators

LAN Local Area Network

LBI Limited Background Investigation

LDAP Lightweight Directory Access Protocol

LEC Local Exchange Carrier

M Memorandum

MEL Material Equipment List

MBI Minimum Background Investigation

MS Microsoft

MSR Monthly Status Report

MTR Meantime To Resolution

NACI

National Agency Check and Inquiry Investigation

NAS Network Attached Storage

NDA Non-Disclosure Agreement

ITSS Next Generation Information Technology Services

NIDS Network-Based Intrusion Detection System

NIH National Institutes of Health

NISPOM National Industrial Security Program Operating Manual

NIST National Institute of Standards and Technology

NITAAC NIH Information Technology Acquisition and Assessment Center (NITAAC)

NLT No Later Than

NOC Network Operations Center

O&M Operations and Maintenance

OCI Organizational Conflict of Interest

OCIO Office of the Chief Information Officer

OCISO Office of the Chief Information Security Officer

OCONUS Outside Contiguous United States

OEM Original Equipment Manufacturer

OGAPA Office of Grants and Acquisition Policy and Accountability

OMB Office of Management and Budget

OA Operating Agency

OS Operating System

OSI Open Systems Interconnect

OSSI Office of Security and Strategic Information

OWASP Open Web Application Security Project

PBX Private Branch Exchange

PC Personal Computer

PDF Portable Document Format

PgM Program Manager

PIA Privacy Impact Assessment

PII Personally Identifiable Information

PIRT Privacy Incident Response Team

PIV Personal Identification Verification

PKI Public Key Infrastructure

PL Public Law

PM Project Manager

PMI Project Management Institute

PMP Project Management Plan

POA&M Plan of Action and Milestones

POC Point of Contact

POE Personally Owned Equipment

POP Period of Performance

PPIRS Past Performance Information Retrieval System

PSC Program Support Center

PTA Privacy Threshold Analysis

PUB Publication

PWS Performance Work Statement

QA Quality Assurance

QCP Quality Control Plan

QoS Quality of Service

RAID Redundant Array of Independent Disks

RBT Role Based Training

RFC Request for Change

RFP Request for Proposal

RFQ Request for Quotation

ROB Rules of Behavior

RPO Recovery Point Objective

SA&A Security Assessment and Authorization

SAN Storage Area Network

SAOP Senior Agency Official for Privacy

SAP / SAR Security Assessment Plan / Report

SB Small Business

SCAP Security Content Automation Protocol

SCSL Supported Commercial Software List

SDLC Software Development Lifecycle

SDM Service Delivery Manager

SGSL Support Government Software List

SIP Session Initiation Protocol

SLA Service Level Agreement

SLO Service Level Objective

SME Subject Matter Expert

SMS Service Management System

SNMP Simple Network Management Protocol

SOC Security Operations Center

SOP Standard Operating Procedure

SORN System of Record Notice

SP Special Publication

SPF Sender Policy Framework

SPOC Single Point of Contact

SSBI Single Scope Background Investigation

SSF Service and Supply Fund

SSL

Secure Sockets Layer

SSP System Security Plan

STIG Security Technical Implementation Guide

T&M Time and Materials

TBD To Be Determined

TDY Temporary Duty

TIC Trusted Internet Connection

TIFF Tag Image File Format

TIN Taxpayer Identification Number

TO Task Order

TOMP Task Order Management Plan

TORFP Task Order Request for Proposal

TS/SCI Top Secret/Sensitive Compartmentalized Information

UAT User Acceptance Test

UCC Unified Communications and Collaboration

UPS Uninterruptible Power Supply

URL Uniform Resource Locator

USC United States Code

US-CERT United States Computer Emergency Readiness Team

USGCB United States Government Configuration Baseline

VM Virtual Machine

VoIP Voice over Internet Protocol

VPN Virtual Private Network

VTC Video Teleconference

WAN Wide Area Network

WAR Weekly Activity Report

WP Work Plan