Appendix D CCB Instructions - Questions PdM MedSim.pptx

Change Control Package PdM MedSim

Questions for a Configuration Control Board (CCB)

Areas and questions to address for all CCB Reviews against desired requested changes to the baseline configuration

The questions should be answered N/A, No and if Yes supporting rationale and explanations should be provided.

Change Control Package PdM MedSim

Instructions for Completing CCB Data Package Information

Detailed Change Proposal Data Package The Data Package should address the items listed in the Impact Analysis guidance. If an LT2 CACP has been prepared, please provide those slides. In order to effectively evaluate the impacts of the change, you will need to provide enough data to enable functional leads to perform an analysis and validate the proposal.

Specific questions in 4 Impact Areas: Engineering, Cyber Security, Logistics and Program Management Each question must be answered to provide a complete picture of the proposed system change.

The Data Package can be in a document or slide deck but must provide details on ALL PROPOSED CHANGES.

If an LT2 Core Asset Change Proposal (CACP) has been prepared, those slides may be provided as well.

Change Control Package PdM MedSim

In order to effectively evaluate the impacts of the change, data must be provided that is sufficient for functional leads to perform an analysis and validate the proposal.

The following items are required at a minimum in order to complete an assessment:

Type of effort (CTR, Modernization, System Interconnection, etc.)

Affected programs and systems Description of proposed change(s) Cost (equipment, licenses, sustainment, personnel, etc.)

Schedule for changes (and effects on associated program schedules) Diagram(s) depicting changed items HW/SW changes proposed Connections that need to be created, modified, or removed Documentation changes required (accreditation, logistics, engineering, training, etc.)

Change Control Package PdM MedSim Potential Engineering Changes Are there any existing requirements in the baseline that conflict with the proposed change?

Are there any other pending requirement changes that conflict with the proposed change?

What are the consequences of not making the change?

Are there possible adverse side effects or other risks of making the proposed change?

Will the proposed change adversely affect performance requirements, functionality, or other quality attributes?

Will the change affect any system component/service/interface that affects critical properties such as safety and security, or involve a product change that triggers recertification (e.g.; ATO, Safety, Spectrum, etc.) of any kind?

Is the proposed change feasible within known technical constraints?

Must any tools be acquired to implement and test the change?

Will prototyping or other user input be required to verify the proposed change?

Identify software or hardware components/services that must be created, modified, or deleted.

Identify unit, integration, system, and acceptance test cases that must be created, modified, or deleted.

Is site coordination required for integration and testing?

Are all components sustainable for the programmed lifecycle?

Will updates require changes to ICD? Which ones?

Will diagrams or other documentation need updating? Correlate this with Logistics impact responses.

Does coordination need to take place with other programs or systems?

Change Control Package PdM MedSim Potential Logistics Impacts Are there any existing requirements in the baseline that conflict with the proposed change?

Are there any other pending requirement changes that conflict with the proposed change?

What are the consequences of not making the change?

Are there possible adverse side effects or other risks of making the proposed change?

Will the proposed change adversely affect performance requirements, functionality, or other quality attributes?

Will the change affect any system component/service/interface that affects critical properties such as safety and security, or involve a product change that triggers recertification (e.g.; ATO, Safety, Spectrum, etc.) of any kind?

Is the proposed change feasible within known technical constraints?

Must any tools be acquired to implement and test the change?

Will prototyping or other user input be required to verify the proposed change?

Identify software or hardware components/services that must be created, modified, or deleted.

Identify unit, integration, system, and acceptance test cases that must be created, modified, or deleted.

Is site coordination required for integration and testing?

Are all components sustainable for the programmed lifecycle?

Will updates require changes to ICD? Which ones?

Will diagrams or other documentation need updating? Correlate this with Logistics impact responses.

Does coordination need to take place with other programs or systems?

Change Control Package PdM MedSim Potential Cyber Security/IA Impacts Have any changes been made to the security products or boundary defense mechanisms used to protect the system? Do the proposed changes require updates to Firewall or network configurations?

Has the system architecture changed? (e.g. changing server locations or topology, local server to centralized server, etc.) If yes, provide a topology map in addition to an explanation.

Does the modification/upgrade require any changes to firewall Ports, Protocols, and network Services (PPS)?

Have any external interfaces, connections, additional ports/protocols been added/changed, or are any connections required to be created, modified, or removed? (e.g. adding dial-up capability, adding connections to a non .mil site, adding remote management, etc.)

Have all Ports, Protocols, and Services changes been captured in the PPS list? In CDRL or on Contract?

Will this change impact this or other current ATOs (require reaccreditation) or affect any (re)accreditation efforts?

Is an MOA or other agreement required?

Are updates to the System Security Plan (SSP) required? In CDRL or on Contract?

Are all HW/SW changes documented in the HW/SW List? In CDRL or on Contract?

Are updates to the STIG checklist required? In CDRL or on contract?

Have any changes to account management procedures or processes been implemented? (e.g. changed definition of administrator duties, location, privileges, super user, etc.)

Change Control Package PdM MedSim Potential Cyber Security/IA Impacts Have any changes to password generation requirements or management been implemented? (If yes, describe system's password management in terms of system's support to Army/DOD password policy, system’s automated means of enforcing password policy, system's enforcement of password changes every 60 days and system's lockout features after unsuccessful login attempts.)

Has remote administration and management been added or changed? (If yes, describe system's remote administration in terms of: software product used for remote administration, encryption mechanism, remote locations [controlling and distant locations], remote administration security training and documentation of remote administration procedures.)

Have any changes in system support been introduced? (e.g. roles, responsibilities) Are all components licensed and supportable for the duration of component and system lifecycles?

Are spares available for all critical components?

Do any changes require additional licenses?

Who owns responsibility for OS and platform configuration baseline?

Are components being fielded to a lab for PDSS support? Who performs PDSS?

Who will perform IA maintenance functions (on contract already)?

Does the existing IAVM plan support the new components/configuration?

Are updates to the Technical Deviation Report required?

Change Control Package PdM MedSim Potential Program Management Impacts Is there a TCM validated requirement for the proposed change(s)?

Is this a customer funded effort?

Is there an MOA/MOU in place to define responsibilities for System Ownership, Configuration Control, Accreditation, Funding and Sustainment Responsibilities?

Who is performing Operations and Maintenance? Is it POMed and funded?

Have all O&M changes been coordinated with Field Ops?

Are IA functions funded and on contract?

Are all changed SW and HW components available to execute PDSS?

Who will perform PDSS?

Where will PDSS be performed?

Does coordination need to take place with other programs or systems?

If this is FMS, are there any Releasability or export control issues?

How will the proposed change affect the sequence, dependencies, effort, or duration of any tasks currently in the project plan?

How much effort that has already been invested in the project will be lost if this change is accepted?