AG-3144-I-16-0059_OCIOIP_Vision.pdf

OCIO Integration Project (OCIOIP)

OCIO Integration Project Vision Page 1 of 13 August 17, 2016

Office of the Chief Information Officer Integration

Project (OCIOIP)

Vision

OCIO Information Resource Management Enterprise Architecture

Division

OCIO Integration Project Vision Page 2 of 13 August 17, 2016

Table of Contents

Table of Contents

1. Introduction

2. Scope

2.1 In Scope

2.2 Out of Scope

3. Stakeholder and User Descriptions

3.1 Stakeholder Summary

3.2 User Summary

3.3 User Environment

4. Project Concept Overview

4.1 Narrative

4.2 Conceptual Diagram

4.3 Conceptual Diagram Components

5. Features

5.1 Business Features

5.1.1 OCIOIP Overview

5.1.2 Strategic Plan Information

5.1.3 Business Information

5.1.4 Investment Portfolio Information

5.1.5 Application Information

5.1.6 Security Information

5.1.7 Technology Information

5.1.8 Reporting

5.2 Future Business Features

5.2.1 Manage IT Roadmaps

5.3 Core Site Features

5.3.1 Role-based Authorization

5.3.2 Accessibility

5.3.3 Mobile Web-friendly Access

5.4 Supporting Features

5.4.1 Authentication

5.4.2 System of Record (SOR) data access

5.4.3 Data Issue Reporting

6. Constraints

7. Precedence and Priority

OCIO Integration Project Vision Page 3 of 13 August 17, 2016

1. Introduction

The United States Department of Agriculture (USDA) needs a common, centralized, and authoritative solution to access consolidated system, application, and investment related information. USDA Office of the Chief Information Officer (OCIO) understands from its customers that there are too many labor intensive data calls, and too many places that Agencies and Staff Offices have to report the same information due to lack of harmonization and coordination across OCIO. The goal of the OCIO Integration solution is to provide a new one stop common, centralized, and authoritative source for consolidated investment, system, and application information that can be used by business and IT professionals across USDA to access what we have and to make better IT investment decisions supporting FITARA, strategic sourcing, and shared services.

Currently three critical functions with OCIO (Capital Planning and IT Governance, Security, and Enterprise Architecture) each operate and maintain their own disparate system. Those three systems do not interface with each other or provide an automated process for reconciling information between them. This lack of integration also creates isolation between the systems and organizations resulting in duplicative information residing in each system and leads to inconsistent data quality across OCIO and the Department.

Furthermore, this limits USDA’s ability to perform effective strategic planning and the OCIO’s ability to produce accurate information and reports in a timely manner.

2. Scope

2.1 In Scope

The scope of the OCIO Integration project is to provide a new common, centralized, and authoritative application to access consolidated system, application, and investment information. The project will analyze the three OCIO systems currently supporting Security (CSAM - Cyber Security Assessment and Management), Enterprise Architecture (EAR - Enterprise Architecture Repository), and Capital Planning and IT Governance (AgMax - Agriculture Maximum) to determine the information available and to develop requirements for the new OCIOIP solution. Phase I is to gather and document requirements for the new system to support strategic planning across USDA and OCIO reporting requirements. An alternatives of analysis will be performed using the new requirements to determine the best recommendations. This solution has the potential to replace the current EA Repository (EAR).

2.2 Out of Scope

The research, analysis, integration, alternative analysis of additional USDA systems beyond Capital Planning (AgMax - Agriculture Maximum), Security (CSAM - Cyber Security Assessment and Management) and Enterprise Architecture (EAR - Enterprise Architecture Repository) systems will not be considered.

The new solution should leverage the existing authoritative systems of record as data sources; however viable cost-effective alternative solutions for the EAR will be considered.

3. Stakeholder and User Descriptions

Stakeholders are the groups whose views and needs must be considered in the requirements process. All teams who must fund, approve, plan, specify, architect, construct, validate, deploy, or operate any resulting solution have important perspectives that should be considered.

Users are those groups that must interact directly with any resulting solution to accomplish required work, whether specific to the business mission or necessary for managing the solution itself. The needs of each of these groups must be thoroughly addressed.

OCIO Integration Project Vision Page 4 of 13 August 17, 2016

3.1 Stakeholder Summary

TABLE 1: Stakeholder Summary

Group Description Representative Responsibilities

USDA

Leadership

• USDA CIO

• USDA DCIO – Policy and Planning

• USDA DCIO – Information Resource Management (IRM)

• Jonathan Alboum

• Joyce Hunter

• Jacqueline Butler

• Mission advocacy & resourcing

• Approve Project

• Set priorities for OCIOIP

USDA

Enterprise Architecture

• Director -Enterprise Architecture Division (EAD)

• Jonathan Benett • Business sponsor and Subject Matter Expert for Enterprise Architecture requirements

USDA

Capital Planning

• Director - Capital Planning and IT Governance Division

(CPIGD)

• Naomi Gumbs • Business sponsor and Subject Matter Expert for Capital Planning requirements

USDA

Security

• Director – Agriculture Security Operations Center (ASOC)

• Kimberly Hennings • Business sponsor and Subject Matter Expert for Security requirements

USDA

Project Team

• Project Team and supporting members

• David Waddell

• Cheryl Vukas

• Holly Beckstrom

• Rhonda Gantt

• Project execution leadership

• Project management & reporting

• Requirements facilitation

3.2 User Summary

TABLE 2: User Summary

Mission Area Capital Planning Advisory

Council (CPAC) Representative

Agencies Represented Enterprise Architecture Committee (EAC) Representative

Natural Resources and Environment

Hubbard- Mieback, Nora S

Debra Hennessy

Eric Shenton

Hien-Hoa Nguyen

Forest Service Eric Shenton

Natural Resources Conservation Service

Mia Wright

Farm and Foreign Agricultural Services

Cheryl Vukas

Rani Agnihotri

Wade Wassenberg

Farm Service Agency Gerald Pattillo

Foreign Agricultural Service Junius Hayes

Risk Management Agency Chip Davis

Rural Development

Daniel Donnelly

Rita Rogers

Rural Utilities Service Mark Biggerstaff

Rural Housing Service

Rural Business Cooperative Service

OCIO Integration Project Vision Page 5 of 13 August 17, 2016

Mission Area Capital Planning Advisory

Council (CPAC) Representative

Agencies Represented Enterprise Architecture Committee (EAC) Representative

Food, Nutrition, and Consumer Services

Kevin Russ

Jyothsna Srigiriraju

Bill Revells

Syed Jaffery

Food and Nutrition Service

David Lee

Center for Nutrition Policy and Promotion

Food Safety Vickie Clark

Daniel Beseris

Food Safety and Inspection Service

Jim Tunnessen

Research, Education, and Economics

Michael Vilivullah Jason Hitchcock

Agricultural Research Service Katherine ChuHickman

National Institute of Food and Agriculture

Jason Hitchcock

Economic Research Service David Nulph

National Agricultural Statistics Service

Elvera Gleaton

Marketing and Regulatory Programs

Agricultural Marketing Service Nita Worley

Animal and Plant Health Inspection Service

Russ Cole

Grain Inspection Packers and Stockyards Administration

Dan Knight

Security Office Juanita Makuta Agriculture Security Operations Center

USDA Offices Nsenga Robinson

Kimberly Womble

Kai Moericke

Randy Maples

Deborah Beck

Delphine Dennis

Sean May

Brian Brotsos

Rhonda Gantt

Ambreen Javed

(OPPM)

Department Offices Jack Blount (NFC)

Chris Nelson (OBPA)

Lisa McFerson (OC)

Tacy Summerset (ASOC)

Dave Larrimore (Cloud)

Janell Duke (EAD)

Brian Brotsos (EAS)

Gary Klesner (EAS)

Todd Johnson (ENS)

Chuck Gowans (NITC)

Kelly Moore (OPPM)

3.3 User Environment

The U.S. Department of Agriculture (USDA) is made up of multiple agencies and offices with nearly 100,000 employees who serve the American people at more than 4,500 locations across the country and abroad. The users of AgMax, EAR, and CSAM are mostly IT professionals, however business users also need the ability to view the information. The majority of the primary users are located in Washington DC, with other major sites located in Kansas City, St. Louis, Fort Collins, and New Orleans.

Users shall be able to access systems through USDA Common Computing Environment (CCE) provided equipment with both intranet and internet access. This environment is established and operational. The expected usage of the solution is 1000 primary users with 40 concurrent users and 150 user hits per month.

OCIO Integration Project Vision Page 6 of 13 August 17, 2016

The solution should interface with the following data source information and not reproduce or replicate it internally:

eAuthentication for user authentication and general application access AgMax - Agriculture Maximum CSAM - Cyber Security Assessment and Management EAR - Enterprise Architecture Repository

The diagram below depicts the USDA Offices and Agencies.

Farm and Foreign

Agriculture Services

Food, Nutrition and Consumer Science

Food Safety

Marketing and

Regulatory Programs

Natural Resources and Environment

Research, Education and Economics

Rural Development

Farm Service Agency

(FSA)

Foreign Agricultural Service (FAS)

Risk Management Agency (RMA)

Center for Nutrition Policy and Promotion

(CNPP)

Food and Nutrition Service (FNS)

Food Safety and Inspection Service

(FSIS)

Agricultural Marketing Service

(AMS)

Animal and Plant Health Inspection Service (APHIS)

Grain Inspection, Packers, and Stockyards Administration

(GIPSA)

Forest Service (FS)

Natural Resources Conservation Service

(NRCS)

Agricultural Research Service (ARS)

Economic Research Service (ERS)

National Agricultural Library (NAL)

National Agricultural Statistics Service

(NASS)

National Institute of Food and Agriculture

(NIFA)

Rural Development

(RD)

USDA Offices

Departmental Management (DM)

Office of the Chief Economist (OCE)

Office of Congressional Relations (OCR)

National Appeals Division (NAD)

Office of the Chief Financial Officer

(OCFO)

Office of Ethics (OE)

Office of Advocacy

(OAO)

Office of the Chief Information Officer

(OCIO)

Office of Environmental Markets (OEM)

Office of the Assistant Secretary for Civil Rights (OASCR)

Office of the Chief Scientist (OCS)

Office of the Executive Secretariat

(OES)

Office of Budget and Program Analysis

(OBPA)

Office of Communications (OC)

Faith‐Based and Neighborhood Partnerships (FBNP)

Office of the General Counsel (OGC)

Office of Tribal Relations (OTR)

Office of the Inspector General

(OIG)

OCIO Integration Project Vision Page 7 of 13 August 17, 2016

4. Project Concept Overview

4.1 Narrative

The Project Context Overview diagram provides a pictorial view of the OCIOIP.

4.2 Conceptual Diagram

4.3 Conceptual Diagram Components

The following table describes the components (as numbered) in the diagram in the previous section.

TABLE 3: Diagram Components

Diagram Layer Functions, Responsibilities and Constraints

Viewer Defines the user allowed to view information in OCIOIP

USDA Data Steward

Defines the user that is allowed to maintain information in OCIOIP

USDA

Administrator

Defines the user that is allowed to maintain system level information in OCIOIP

AgMax Agriculture Maximum: The system of record for Capital Planning and Investment data

EAR Enterprise Architecture Repository: The system of record for Enterprise Architecture data

CSAM Cyber Security Assessment and Management: The system of record for system and security data

OCIO Integration Project Vision Page 8 of 13 August 17, 2016

5. Features

This section outlines needed OCIOIP features as high-level capabilities delivering envisioned system benefits to users and stakeholders. This features set will be adjusted as full requirements and designs are documented. The goal is to provide as many valuable capabilities as possible within the time frames and resources available.

5.1 Business Features

The features identified in this section support basic business functionality to insure that the site provides useful information to its customers.

5.1.1 OCIOIP Overview

Five natural summary perspectives form the overview of data within the OCIOIP Application. (1) Strategic Plan, (2) Business, (3) Investment Portfolio, (4) Application, and (5) Security. These 5 data areas should be designed modularly, allowing sections to be grouped and packaged into larger summaries.

5.1.1.1 Agency Selection

Provide the ability for a user to identify the agency they wish to see information about from the agencies allowed access to. If a user has access to only one agency, then the application should default to that agency and not require the user to select it. The remaining features should only display information from the currently selected agencies.

5.1.1.2 Fiscal Year (FY) Selection

Provide the ability for a user to identify the fiscal year they wish to see information about.

The remaining features should only display information from the currently selected fiscal years.

5.1.1.3 OCIOIP Dashboard

Provide a customer-centric dashboard overview of the features provided in sections 5.1.2 (Strategic), 5.1.3 (Business), 5.1.4 (Investment) 5.1.5 (Application Overview), and 5.1.6 (Security Overview). The dashboards should provide infographic overviews with drill-down capabilities.

5.1.2 Strategic Plan Information

USDA maintains business and IT strategic plans at the USDA and agency level.

5.1.2.1 Strategy Plan Information Dashboard

Provide a customer-centric dashboard overview of strategic plan information. The dashboards should provide an infographic overview with drill-down capabilities.

5.1.2.2 View Strategic Plan Framework

Display the business and IT strategic plan framework. Information should be sourced from the EAR system. Components of the strategic plan framework should include

Goals

Objectives

Strategic priorities

Initiatives

Performance metrics

Associated descriptions

Alignment between USDA and agencies

OCIO Integration Project Vision Page 9 of 13 August 17, 2016

5.1.3 Business Information

USDA maintains business capability and organizational structures at the USDA and agency level.

5.1.3.1 Business Information Dashboard

Provide a customer-centric dashboard overview of the business information provided in this section. The dashboards should provide an infographic overview with drill-down capabilities.

5.1.3.2 View Business Capability Framework

Display the business capability framework. Information should be sourced from EAR system. Components of the business capability framework should include

Business Capabilities and associated descriptions

Business Capability assessment

Business Capability heat map

Business Capability roadmap

Business Capability associations to Strategic Plan components

5.1.3.3 View Enterprise Architecture Reference Models

Display the current EA reference models used within USDA. Information should be sourced from EAR system. Model should include

Performance Reference Model (PRM)

Business Reference Model (BRM)

Data Reference Model (DRM)

Application Reference Model (ARM)Infrastructure Reference Model (IRM)

Security Reference Model (SRM)

USDA Reference Models

5.1.3.4 View Organization Chart

Display the organization chart. Information should be sourced from EAR system.

Components of the organization chart should include

Position and associated description

Employee name

Hierarchy

Organization associations to Business Capability components

5.1.4 Investment Portfolio Information

USDA maintains investments and associated information at the USDA and agency level.

5.1.4.1 Investment Portfolio Information Dashboard

Provide a customer-centric dashboard overview of the investment information provided in this section. The dashboards should provide an infographic overview with drill-down capabilities.

5.1.4.2 View Portfolio Information

Display the portfolio information. Information should be sourced from the AgMax system.

Components of the portfolio framework should include

OCIO Integration Project Vision Page 10 of 13 August 17, 2016

Agency IT Portfolio Summary (Formerly OMB Exhibit 53)

5.1.4.3 View Investment Information

Display the investment information. Information should be sourced from the AgMax system. Components of the investment information should include

IT Business Case and Business Case Detail (Formerly OMB Exhibit 300)

Investment associations to Organizations

5.1.4.4 View Acquisition Approval Request (AAR) Information

Display AAR information. Information should be sourced from the AgMax system.

Components of the investment information should include

AAR work flow status

AAR cover letter, with status and conditions

AAR templates

AAR associations to Investments

5.1.5 Application Information

USDA maintains application and system information at the USDA and agency level.

5.1.5.1 Application Information Dashboard

Provide a customer-centric dashboard overview of the application information provided in this section. The dashboards should provide an infographic overview with drill-down capabilities.

5.1.5.2 View System Inventory

Display the system inventory. Information should be sourced from the EAR.

Components of the system inventory should include

EAR system attributes

System Hierarchy (Header, System, Sub-System, etc.)

System associations to investments

System associations to business capabilities

System associations to organization structure

System association to AgMax system

System association to CSAM system

5.1.6 Security Information

USDA maintains security information at the USDA and agency level.

5.1.6.1 Security Information Dashboard

Provide a customer-centric dashboard overview of the security information provided in this section. The dashboards should provide an infographic overview with drill-down capabilities.

5.1.6.2 View CSAM Systems

Display the CSAM systems. Information should be sourced from the CSAM system.

Components of the CSAM systems should include

CSAM system attributes

OCIO Integration Project Vision Page 11 of 13 August 17, 2016

Authority to Operate (ATO) information

Assessment & Authorization (A&A) information

System Hierarchy (Header, System, Sub-System, etc.)

System association to AgMax system

System association to EAR system

5.1.6.3 View Security Risk Assessment Plan of Action and Milestones (POAM)

Display the Security Risk Assessment POAM information. Information should be sourced from the CSAM system. Components of the Security Risk Assessment POAM should include

CSAM POAM attributes

5.1.6.4 View FISMA Reporting

Display the FISMA Reporting information. Information should be sourced from the CSAM system. Components of FISMA Reporting should include

CSAM FISMA Reporting attributes

5.1.7 Technology Information

USDA maintains technology information at the USDA and agency level.

5.1.7.1 View IT Approved Software

Display the approved list of IT software in use at USDA. The list should provide information on both COTS and Open Source software as well as the appropriate software categories.

5.1.7.2 View IT Technology Roadmap

Display the IT Technology Roadmap for the approved IT Software.

5.1.8 Reporting

Reporting of the information available within the application is needed to make the information consumable and to reduce the burden of agencies to support both data calls, FITARA requirements and portfolio reviews.

5.1.8.1 Data Calls

Provide a method to generate reports to support adhoc data calls. The user should be able to select the reporting elements and the report type (excel, pdf, etc.)

5.1.8.2 FITARA

Provide reports to support FITARA compliance requirements. Reports should include the following:

TBD

5.1.8.3 Portfolio Review

Provide reports to support the portfolio review requirements. Reports should include the following:

TBD

OCIO Integration Project Vision Page 12 of 13 August 17, 2016

5.2 Future Business Features

The features identified in this section represent the enterprise architecture features needed to support the laws, regulations and policies governing enterprise architecture.

5.2.1 Manage IT Roadmaps

TBD

5.3 Core Site Features

The features identified in this section represent the core features identified to support basic system functionality to insure that the site is well organized, user friendly, and extensible. These must be considered during the initial build out of the site to reduce rework as additional features are incorporated.

5.3.1 Role-based Authorization

The specific roles assigned to specific users (based on business policy) will change the functions that the system will allow specific user to perform and the information that they will be allowed to see or change. Users roles should be derived from available user profile information and create a heavy burden for user administration.

5.3.2 Accessibility

Although accessibility requirements have often been met inconsistently at USDA, the OCIOIP represents an opportunity to address that shortcoming. This solution must conform to accessibility requirements established by Section 508 of the Rehabilitation

5.3.3 Mobile Web-friendly Access

The OCIOIP must be presented in both desktop screen and a mobile version using a responsive design with a single code base

5.4 Supporting Features

The features identified in this section represent items needed to support the website functionality but not necessarily functionality directly within the OCIOIP application.

5.4.1 Authentication

A reliable mechanism is needed for authenticating the identity of USDA customers by associated agency who have been approved for online access. The USDA already has a standard solution (eAuthentication) for positively identifying users who can rightfully access secured data. The existing system shall be used to secure and provide authentication services for this application.

5.4.2 System of Record (SOR) data access

Access to data from the system of record for security, enterprise architecture and capital planning is needed. This access can be provided through daily extract, transform, and load (ETL) processes or through SOA services if available. Data within the OCIOIP application should be no more than 1 day old.

5.4.3 Data Issue Reporting

There may be discrepancies in the identification of systems between each of the systems of record for OCIOIP. A report should be provided that identifies these issues.

6. Constraints

The following business constraints or other dependencies guide this vision and subsequent solutions.

The ultimate solution delivered is limited to funding that can be realized within the predefined FY16 and FY17 budget execution levels.

OCIO Integration Project Vision Page 13 of 13 August 17, 2016

The definition of system, subsystem and application are not consistent across the security, enterprise architecture, and capital planning systems. No changes to the definitions within the existing systems definitions is anticipated at this time, however a clear definition of these terms is needed for the new system that will ensure the information is properly aligned and consumable.

7. Precedence and Priority

The following table identifies the precedence and priority of the features identified in section 5. This list will be evaluated by IT and an Overall Iteration Plan will be developed that takes into account dependencies, available of functionality, and overall feasibility.

Feature Priority

High

High

High

High

Medium

Medium

Medium

Low