Appendix 9 - NARA SDLC Tailoring Plan for Presidential Libraries Ticketing System.pdf

TAILORING PLAN & STAGE GATE APPROVALS

CAPITAL PLANNING & INVESTMENT CONTROL (CPIC)

General Information

Investment Name: Legislative Archives, Presidential Libraries, & Museum Services (L)

Project Name: Presidential Libraries Ticketing System

Submission Date: 6/12/2025 CPIC ID: 23290P

Business Liaison: TBD eMail:

System Owner: Tamara Martin eMail:

Tamara.Martin@nara.gov

Program Manager: Shahzad Shaikh eMail:

shahzad.shaikh@nara.gov

Project Manager: Michael Anderson eMail:

michael.anderson@nara.gov

1. Project Scope / Objectives

An integrated ticketing customer relationship management (CRM) system, accessible to the Presidential Library visitors both onsite and online, will allow NARA staff to better manage visitor flow, promote deeper exploration of onsite and online experiences, and expand the visitor experience well beyond the specific ticketed day by sending curated pre-visit and post-visit information via email such as satisfaction surveys, accessibility information, and other relevant data that allow guests to build an itinerary and customize their experience.

A robust cloud-based ticketing CRM system can support information collection, which may in turn be used for reporting and planning future programming. This data includes visitor counts and demographic information, and options to provide program feedback and audience evaluations that will allow NARA staff to better track customer satisfaction and make adjustments as needed.

2. Strategic Alignment

GOAL 2: CONNECT WITH CUSTOMERS

3. Work Stream Type

� Used for new systems that: (a) require significant custom development; (b) use modified COTS products to satisfy requirements; or (c) include both custom-developed and COTS software elements.

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 1 OF 12NA FORM 8024 (8-22)

REQUIRED BY NARA 801

4. Project Type

Determine the project type by evaluating the scope of the project and the nature of the system being developed, procured, or upgraded. Increased project complexity leads to increased risk. Based on the project scope and objectives described in Section 1, select the project type that most closely describes the project complexity and then describe why below.v

� Low complexity A COTS solution is desired that would integrate with the existing workflow and reduce development time.

4.1) Is this an existing system?

� No.

4.2) In working with IT Security Management, identify the Security Categorization (SC).

The Information and Information System have a security categorization of Choose an impact.

SC = Confidentiality-Moderate; Integrity -Moderate; Availability -Moderate.

5. Development Methodology

Determine the development process or series of processes that will be used to develop the software/product.

� Waterfall Methodology

This project is considered a Waterfall project because it follows a linear and sequential approach, with clearly defined stages and requirements that do not expect major changes once the project begins. Here’s a breakdown of why it fits the Waterfall model:

● The project already outlines a defined scope of work: implementing a new integrated ticketing CRM system.

● Specific objectives and needs are established upfront (e.g., replacing VSS, integrating kiosks, automating communications).

● The solution (Etix or Tessitura) is already being considered, indicating a clear vision and minimal ambiguity.

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 2 OF 12NA FORM 8024 (8-22)

6. Stage Gates & Work Products

Once the work stream type and project type are determined, identify which work stream tasks are recommended for this project, as well as the associated work products for each stage gate review and the party responsible for providing or delivering the work products. The table is pre-populated with many of the basic documents required for each task or stage gate, based on the general characteristics of the work stream type. Update the table based on the needs of this particular project, based on feedback from the Integrated Project Team (IPT) or subject matter experts (SMEs). Additional tasks identified for high complexity projects and projects having high information assurance risk may be added to the work stream task. It is also advised to meet with each process/stage gate owner.

Work products may correlate to contract deliverables.

Work Stream Task Work Products

Responsible Party (for artifacts)

Notes / Recommendations

Enterprise Architecture Review

1. Business Need

2. Technical Assessment & Recommendation (TAR)

1. PgM

2. CPIC

● Was the business need documented and signed by the Executive Sponsor? If not, explain why not.

● Was a TAR provided and signed by the CTO? If not, explain why not. Provide governance dates.

Acquisition Planning

1. Acquisition Strategy

2. Acquisition Plan

1. PgM

2. PgM

● Type of Solicitation

● How advertised

● Source selection panel

● Time frame for the award

Concept Development

1. Investment Proposal Package

2. Business Case

3. High-level Business Requirements

4. Performance Metrics/Success

Factors

5. Independent Government Cost

Estimate (IGCE)

6. Concept of Operations (CONOPS)

7. Identify Stakeholders

8. Identify the Integrated Project Team

(IPT)

1. PgM

2. PgM

3. PgM

4. PgM

5. PgM

6. PgM

7. PgM

8. CPIC

● Was an investment proposal or a business case developed? If not, explain why not (i.e., documents used to develop or analyze the as-is and to-be).

Risk Management

1. Risk Management Plan

2. Risk Register

1. PM

2. PM

● All risks will be recorded in the PM tool.

● Risk will be evaluated periodically by the IT Risk Manager and the Project Review Board, and at each stage gate.

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 3 OF 12NA FORM 8024 (8-22)

Responsible Party (for artifacts)

Notes / Recommendations

Configuration Management

1. Configuration Management Plan

(CMP)

2. Configuration Item List (CIL)

3. Request for Change (RFC) Form (Operations Readiness Stage Gate (ORSG))

1. CM/PM

2. CM

3. PM

● CMP will be developed by the CM team

● Initiate an RFC for deployment or any changes.

Project Management

1. Project Schedule

2. Training Plan

3. Training manuals

1. PM

2. PM/Vendor

3. PM/Vendor

● Update document status

● Gov't or Vendor completing

● Note any training requirements/deliverables will be provided by the Vendor.

Documents will be collected by the PM.

Requirements Stage Gate

(RSG)

1. Updated Requirements Verification Traceability Matrix (RVTM) to include stakeholder-level requirements

2. Approved Tailoring Plan (TP)RSG Signed TP

1. IR

2. RSG Chair

● Provided that the business stakeholders approve the stakeholder-level requirements in an updated RVTM, then a Requirements Stage Gate waiver will be granted.

● RSG Chair must sign off on the

TP.

Design Stage Gate (DSG)

1. CONOPS Updated

2. Architecture Design

3. Implementation design documents

4. Data Migration Plan

5. Capabilities Mapping

6. System Design Document

7. DSG Signed TP

1. Vendor

2. Vendor

3. Vendor

4. Vendor

5. Vendor

6. Vendor

7. IT

● All Stage gate documents required

● DSG is recommended and will be virtual.

● DSG Chair must sign off on the

TP

● Once the DSG review is approved.

Testing Stage Gate (TSG) 1. TSG Signed TP

2. Test Results Report

3. Test Plan

4. User Sign-off Agreement

5. Overall Defect Report

6. Section 508 Test Report

7. Go Recommendation

8. Test Procedures with Pass/Fail status

9. Release Notes

10. RVTM (mapping requirements to test cases with pass/fail status)

11. Accessibility Conformance Report

(ACR)

12. Supplemental Accessibility

Report(s) (SAR) as needed

1. TSG Chair

2. IQ & Vendor

3. IQ & Vendor

4. Stakeholder 5 . IQ & Vendor

6. IQ

7 . IQ

8 . IQ & Vendor

9. Vendor

10. IQ & Vendor

11. Vendor

12. Vendor

● IQ Test will be in a hands-on testing role

● Test the stage gate is required

● The TSG Chair must sign off on the TP once the TSG review is approved.

● The application/website must be Section 508 compliant to WCAG

2.0 Level AA standards

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 4 OF 12NA FORM 8024 (8-22)

Responsible Party (for artifacts)

Notes / Recommendations

Operations Readiness Stage Gate (ORSG)

1. Maintenance and Patching Plan

2. Transition to Operations (TTO)

3. Service Level Agreement (SLA)

4. Operational Impact Assessment

5. Decommissioning Checklist

6. Request for Change (RFC) Form

7. ORSG Signed TP

1. IO

2. IO

3. IO

4. IO

5. IO

6. IO

7. IO

● Recommend if a gate is required, and why.

● Update the list of recommended work products

● Identify who is responsible for the documents.

● Additional relevant notes.

● ORSG Chair must sign off on the

TP once the ORSG review is approved

Operations and Maintenance Stage Gate

(OMSG)

1. Operations and Maintenance (O&M) Plan (OMP)

2. Operational documentation creation/updates (i.e., patching processes, monitoring, account management, etc.)

3. Design Documentation (From DSG)

4. CMDB Documentation (From

Configuration Management Gate)

5. Request for Change (RFC) (From

ORSG)

6. O&M Risk Assessment

7. OMSG Signed TP

1. Vendor

2. Vendor

3. From DSG

4. From CM

5. Vendor

6. ID

7. ID

● OMSG is required.

*Work Product Notes*

● The OMP is needed to show how knowledge transfer, Licenses, etc, will be provided to the respective O&M team.

● Operational documentation creation/updates are necessary to ensure the system can be maintained properly by the respective O&M team.

● Design and CMDB documentation are for reference purposes only from the respective gates. No new documentation is required.

● O&M Risk Assessment of system changes, support needs, etc, to be performed upon receipt of OMSG materials.

● RFC is required to be elevated to Production.

Security Stage Gate (SSG)

1. FIPS 199 Assessment

2. System Security Plan (SSP)

3. Business Impact Assessment (BIA)

4. Privacy Impact Assessment (PIA)

5. Digital Identity Risk Assessment

(DIRA)

6. Contingency Plan (CP)

7. Risk Assessment Report (RAR)

8. Security Assessment Report (SAR)

9. POA&M

10. Certifier Recommendation

11. Security Stage Gate Decision Sheet

12. Authority to Operate (ATO) Letter

1. ISSO/SO

2. ISSO

3. IS/SO

4. NGC

5. IS

6. ISSO/SO

7. IS

8. IS

9. ISSO/SO

10. IS

11. IS/NGC

● A Security and Privacy Stage Gate is required

● Provide an approved copy of the Tailoring Plan for sign-off.

● Update the list of recommended work products

● Identify who is responsible for the documents.

● Additional relevant notes

● ATO recommendation does not constitute that the system may be deployed or implemented.

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 5 OF 12NA FORM 8024 (8-22)

Responsible Party (for artifacts)

Notes / Recommendations

13. SSG Signed TP

12. IS/AO/SO

13. IS

● SSG Chair must sign off on the TP once the SSG review is approved.

______________________________________ ☐ Approved Chairperson, Stage Gate Review Board (Sign and Date)

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 6 OF 12NA FORM 8024 (8-22)

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 7 OF 12 NA FORM 8024 (8-22)

REQUIRED BY NARA 801

7. Approvals

The Chairperson of each stage gate must sign-off on their respective signature block(s) below indicating results of the review or when gate is not required. Only when the Chief Information Officer (CIO) signs-off on this Tailoring Plan and the ATO can the system be deployed or implemented.

Chairperson, Requirements Stage Gate

Chairperson, Design Stage Gate

Chairperson, Testing Stage Gate

Chairperson, Operational

Readiness Stage Gate

Chairperson, Security Stage Gate

Chief Information Officer

Approved

Not Required

Approved with Conditions

Approved

Not Required

Approved with Conditions

Approved

Not Required

Approved with Conditions

Approved

Not Required

Approved with Conditions

Approved

Not Required

Approved with Conditions

Approved

INSTRUCTIONS:

All projects are required to develop a tailoring plan. Tailoring the project is a critical work activity that gets performed during the concept stage of a project. A tailoring plan helps projects identify and plan work activities that are necessary to achieve successful project outcomes. Every project and system differs in scope, complexity, and risk. This makes it necessary to tailor the work activities to the specific needs of a project. The tailoring plan is developed by the project manager with the assistance of the Integrated Project Team (IPT) if an IPT is assigned.

After analyzing the business need and assessing the requirements in the business case, including identifying the project scope, objectives, and strategic alignment, there are four basic steps to consider when developing a tailoring plan:

STEP 1: Determine the Strategic Alignment This information can come straight from the business case. If you do not have a business case associated with your project, the PM must identify the alignment. Please find the Strategic Goals below:

● GOAL 1: MAKE ACCESS HAPPEN

o Make all records available o Describe All Holdings Online o Digitize All Analog Records o Accelerate Processing

● GOAL 2: CONNECT WITH CUSTOMERS

o Improve Customer Engagement o Customer Service o Public Participation o Public Engagement o Virtual Regulatory Environment

● GOAL 3: MAXIMIZE NARA’S VALUE TO THE NATION

o Reform and Modernize o Permanent E-Records o Automate RM o Drive Use and Re-Use o Direct Access

● GOAL 4 - BUILD OUR FUTURE THROUGH OUR PEOPLE

o Empowerment, Openness, and Inclusion o Leader Culture o Internal Communication

STEP 2: Determine the Work Stream Type.

SDLC work streams are workflow descriptions used for planning and managing projects. They identify broad types of system implementation projects (e.g., custom application development or IT infrastructure upgrade). The PM should decide which work stream most closely describes the project (copy and paste that choice in this section) and then describe specifically why he/she think it fits in that category.

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 8 OF 12NA FORM 8024 (8-22)

http://www.nara-at-work.gov/strategic_planning_and_reporting/strategic-goal-1.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-1-1-1.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-1-1-2.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-1-1-3.html http://www.nara-at-work.gov/strategic_planning_and_reporting/strategic-goal-2.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-2-1-1.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-2-1-2.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-2-1-3.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-2-1-4.html http://www.nara-at-work.gov/strategic_planning_and_reporting/strategic-goal-3.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-3-1-1.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-3-1-2.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-3-2-1.html http://www.nara-at-work.gov/strategic_planning_and_reporting/strategic-goal-4.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-4-1-1.html http://www.nara-at-work.gov/strategic_planning_and_reporting/initiative-4-1-2.html

SDLC Work Streams

Work Stream Description

Business Application Work Streams

New Custom Developed or COTS Application

Used for new systems that: (a) require significant custom development; (b) use modified COTS products to satisfy requirements; or (c) include both custom-developed and COTS software elements.

New Software as a Service (SaaS) Application

Used for new systems that will be: (a) provisioned external to NARANET by an external service provider; (b) accessed over the Internet using a web browser; and (c) used “as-is” based upon a vendor-defined Service Level Agreement.

Application Upgrade Used to upgrade the business software of an existing system, either to: (a) add significant new functional capabilities; (b) make significant changes to the underlying database structure, application architecture, or application platform of a COTS product; or (c) dispose of an application.

Application Maintenance

Used for routine maintenance, bug fixes, or minor functional enhancements to an existing business application.

IT Infrastructure Service Work Streams

New IT Infrastructure Capability

Used to provision new IT infrastructure services. Examples include the enterprise wireless deployment and Storage Network Infrastructure (SNI).

New Platform as a Service (PaaS) / Infrastructure as a Service (IaaS) Capability

Used to implement IT infrastructure capabilities that will be: (a) provisioned external to NARANET by an external service provider; (b) accessed via NARA’s Internet interface;

and (c) used predominantly “as-is” based upon a Service Level Agreement (SLA).

Major IT Infrastructure Upgrade

Used to upgrade an existing IT infrastructure service that: (a) adds significant new capabilities; (b) significantly impacts interoperability with other IT infrastructure services;

(c) makes significant changes to underlying service technologies; (d) moves in-house infrastructure services to an external service provider; or (e) disposes of an existing IT Infrastructure system or service. Examples include NARANET Server Upgrade (NSU), MPLS migration, and cloud-based email.

IT Infrastructure Refresh

Used to upgrade hardware, system software, or network devices that will minimally impact current configuration settings or interoperability with other IT components. Examples include switch replacements, router upgrades, desktop COTS software updates, or server upgrades that do not affect the application platform.

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 9 OF 12NA FORM 8024 (8-22)

STEP 3: Determine the Project Type.

General characterization of the type of project that is being performed. Project type is determined by system complexity and project scope because, ultimately, these two attributes drive cost, schedule, and risk when implementing technology-intensive systems. As a project’s scope increases and a system gets more complex, additional project management and systems engineering work activities are required. Select one from the three types of projects listed below.

SDLC Project Types

Type of Project Key Attributes

Low Complexity Project ● The schedule to achieve Full Operating Capability (FOC) is less than 12 months.

● FOC will be implemented by a single-phase project.

● Interfaces to other systems are not required, or are simple and easy to accommodate.

● The impact on NARANET is well understood and is easily accommodated.

● Requirements are well understood, or can be elicited and verified in a short timeframe.

● Minimal software development or data conversion is required.

● Solutions are generally available off-the-shelf or as a service.

● The system being developed is isolated to a single business function or business office.

● Expertise across many business or technical disciplines is not required.

● O&M costs and impacts are well understood and easily accommodated.

● Acquisition requirements are minimal and easy to define.

● There would be minimal business impact if the project fails.

Medium or High Complexity Project (Projects of medium and high complexity have the same basic attributes. The complexity of a project typically increases as the complexity of the system increases, and the scope of the project expands in terms of capabilities provided, schedule duration, resource needs, integration difficulty, and business/technical impact – all of which tend to increase cost and risk.)

● The schedule to achieve Full Operating Capability (FOC) extends beyond 12 months.

● System capabilities will be implemented by multiple-phase projects or in increments.

● Interfaces with other systems are required.

● The system introduces significant impacts to NARANET and IT operations.

● Software development and/or data conversion is required.

● Requirements are not well understood at the onset of the project.

● Expertise across several business process areas or technical disciplines is required.

● New technologies and/or new business processes are being introduced.

● Prototyping and/or proof-of-concept efforts may be necessary.

● Significant acquisition support is required across several system life cycle stages.

● There could be a significant impact on customer service, business performance, commitments, or business mission execution if the project fails.

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 10 OF 12NA FORM 8024 (8-22)

High Information Assurance Risk Project

● Handles or stores classified information.

● Handles or stores PII data.

● Handles or stores restricted access data (e.g., Title-13, HIPAA).

● Handles or stores permanent archival records or their associated metadata.

● Handles or stores financial information.

STEP 4: Existing Systems Provide the System Categorization

This section will only be filled out for existing systems. New systems will not have this information until it goes through the security stage gate prior to deployment.

STEP 5: Determine the Development Methodology

STEP 6: Tailor the work stream tasks and work products.

Determine which specific work stream tasks, in section 5, need to be performed and in what order to actually implement the system. Align the tasks that must be performed with the outcomes that are required at the various gate reviews. Identify the work products that will be developed to achieve those outcomes.

NOTE: Delete any work products not required. Do not cross out.

DEFINITIONS:

At each stage of the project lifecycle, different individuals and committees are often tasked with reviewing and approving the stage gate before the project team is allowed to proceed to the next stage. Stage Gates are categorized into two types, “Hard” and “Soft”.

“Hard” gates are stage gates in which the project team cannot proceed to the next stage before receiving approval from the current stage. However, “Soft” gates are stage gates in which the next project lifecycle stage can proceed even if the current stage hasn’t been approved. Below are workstreams that are considered “Hard gates”:

Requirements Stage Gate: Is a formal review of an IT project's requirements and/or other business analysis work products to help ensure the quality of said work products by identifying potential gaps and other defects. This review is performed by representatives of the Information Services functional organizations and, as such, incorporates IT concerns outside of the business.

Design Stage Gate: Is a formal review of the design activities that synthesize the proposed system solution that meets the system requirements. Examines the proposed system architecture and design, and the flow down to all functional elements of the system.

Testing Stage Gate: Is a formal review of the structured, formal inspections conducted to determine if the final IT solution that has been developed or acquired meets the stakeholder and design requirements and is fit for use in the production environment.

Operational Readiness Stage Gate: Is a formal review conducted to determine if the final IT solution that has been developed or acquired is ready to transition into an operational mode under the purview of IT Service Operations Delivery

(IO).

Operations and Maintenance Readiness Stage Gate: Is a formal review conducted to determine if the final IT solution that has been developed or acquired is ready to transition into operations and maintenance under the purview of Development and Tools Management (ID).

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 11 OF 12NA FORM 8024 (8-22)

Security Stage Gate: Is a formal assessment of the IT solution being developed or undergoing software, hardware, and/or communication modification(s) before granting the Authority to Operate (ATO). The objective of the security assessment process is to validate that the IT solution complies with the functional and security requirements and will operate within an acceptable level of residual security risk. Testing of security controls is based on the assessment procedures detailed in NIST SP 800- 53A.

Summary of Changes

Version Date Author Changes Made

0322 3/11/2022 CPIC/IJ Complete revision.

0822 8/18/2022 Edlouie Ortega Revision completed

NATIONAL ARCHIVES AND RECORDS ADMINISTRATION PAGE 12 OF 12NA FORM 8024 (8-22)

Check Box9: Yes