Attachment J.19. - Peace Corps OCIO Enterprise Architecture.pdf

0 | P a g e

An overview of the operating model, governance structure, processes and IT portfolio of Peace Corps

Peace Corps Enterprise Architecture April 28, 2021

Behuncik, Mark

1 | P a g e

Table of Contents 1 Executive Summary

2 Operating Model

2.1 Organizational Chart

2.2 Programs and Portfolios

2.3 Solutions Delivery Framework

2.4 Approved Project Portfolio

3 Governance

3.1 Governance Entities

3.1.1 Technology Advisory Board (TAB)

3.1.2 Steering Committees

3.1.3 Service Strategy and Governance (SSG)

3.1.4 Information Security (InfoSec)

3.1.5 Administrative Services, Administrative Officer (AO)

3.1.6 Enterprise Architecture Working Group (EAWG)

3.1.7 Change Control Board (CCB)

3.1.8 CIO Leadership Council (CLC)

Enterprise Architecture Policies and Procedures

4 Service Management

4.1 EAWG Review of Service and Change Requests

4.1.1 Challenges

4.1.2 EA Criteria for Review and Approval of Service Requests

4.1.3 EA Criteria for Review and Approval of Change Requests

4.2 Service Request

4.3 Change Request

4.4 Incident Report

5 Approved Information Technology Asset Inventory

5.1 Enterprise Hardware and Software

5.2 Application Software

5.3 FISMA Systems

5.3.1 Boundary Realignment Future State FY22-23

5.4 Cloud Services

5.5 Product Portfolio by Program

2 | P a g e

5.5.1 Volunteer Lifecycle

5.5.2 Business Operations and Knowledge

5.5.3 Cybersecurity

5.5.4 Workplace Services

5.5.5 Technology Services

6 Data Architecture

6.1 Records Management

6.2 Volunteer Lifecycle Data

6.3 Information Types

6.4 Program Product Portfolios with Information Types

6.4.1 Volunteer Lifecycle

6.4.2 Business Operations and Knowledge

6.4.3 Cybersecurity

6.4.4 Workplace Services

6.4.5 Technology Services

7 Network Architecture

7.1 Domestic Architecture

7.2 International Architecture

8 Security Architecture

8.1 Program, Policy & Governance

8.1.1 Tier 1: Organization Level

8.1.2 Tier 2: Mission/Business Level

8.1.3 Tier 3: Information System

8.1.4 Security and Privacy Controls

8.1.5 Enterprise Architecture and Security Architecture Alignment

8.2 Information Security Services

8.3 Agency Enterprise Risk Management Program

9 OCIO Roadmap

Signatures

References

3 | P a g e

1 Executive Summary Enterprise Architecture (EA) is a federally-mandated, management best practice for aligning business and technology resources to achieve strategic outcomes. There are multiple frameworks that describe how an enterprise architecture should be organized and presented. These frameworks help communicate using common terms and by leveraging best practices.

Peace Corps’ EA has adapted the Federal Enterprise Architecture Framework (FEAF) v2 and Gartner’s discipline of Enterprise Architecture to deliver a practical approach to the governance of Peace Corps’ considerable investment in information technology (IT). The focus of EA is on understanding, maintaining and improving IT capabilities to deliver business-driven outcomes.

This document outlines the operating model, governance, service management, approved information technology assets, data architecture and OCIO roadmap for the Agency. References are included at the end of the document providing additional supporting documentation and process.

Updates for 2021 include more details on the Agency’s Network Architecture, Security Architecture, Data Architecture, Records Management and an updated FISMA system inventory to include a preview of the boundary rationalization planned over the next two years.

4 | P a g e

2 Operating Model An operating model represents how an organization delivers value to its customers and runs itself. It is a framework, and as such, merely represents the component parts of the organization.

2.1 Organizational Chart

The OCIO underwent a reorganization in FY2020. Two outcomes were achieved. Delivery of IT products and services were better aligned to customers and placed under the control of the Deputy CIO while financial, security and strategic activities were moved under the CIO.

This was a significant change given CIO’s past functional organization that merely took orders and reacted to issues. MS 129 Office of the Chief Information Officer: Organization, Mission, and Functions, elaborates on the services offered by the OCIO delivered via the business offices represented in the organization chart below.

Figure 1 - OCIO Organization Chart

2.2 Programs and Portfolios

Five programs were established to organize work and better manage customer demand. Each program has a portfolio of products and services, each with a budget. Programs with more than one Program

Manager, due to the size of their portfolio, is noted below. The programs are as follows.

Volunteer Lifecycle Program – represents stakeholders involved in the recruitment, placement and support of Volunteers before, during and after service. There are two Program Managers. One for

In-Service and another for Pre-Service, Post-Service and Medical Services.

o Volunteer 3rd Goal – Software, tools, and services used to manage and enable returned

Volunteers to engage with the general public. This includes products such as the RPCV

Portal.

5 | P a g e o Volunteer Collaboration – Software, tools, and services used to enable Volunteers to share work and communicate with other Volunteers, agency staff, and counterparts.

o Volunteer Health – Software, tools, and services used to ensure the health and wellbeing of

Volunteers. This includes products such as MAXx and PCMEDICS.

o Volunteer In-Service – Software, tools, and services used to manage and monitor Volunteers when serving. This includes products such as VIDA and VRT.

o Volunteer Recruitment – Software, tools, and services used to recruit, assess, select, and place Volunteers for service. This includes products such as DOVE and PCrm.

Business Operations and Knowledge Program – represents stakeholders involved in supporting business operations and the knowledge necessary to operate and support the Agency. There are three Program Managers. One for Business Operations, one for Knowledge Management, and another for Process and Insights.

o Analytics and Reporting – Software, tools, and services to produce dashboards and analysis reports to enable business decisions. Includes products such as Tableau and SPSS, used by

OSIRP, OHS, and VRS/OAE.

o Asset Management – Software, tools, and services to manage the Agency's assets. This includes products such as Sunflower.

o Business Management – Software, tools, and services to support agency wide functions and meet compliance mandates, and provides for non-Peace Corps specific work processes.

Products include various case management tools, travel management, and file management programs.

o External Communications – Software, tools, and services to manage both the Agency's external website and external communications.

o Financial Management – Software, tools, and services to manage the financial systems and processes of the agency. This includes products such as Odyssey.

o HR Management – Software, tools, and services to manage the talent management lifecycle.

This includes products such as CareerConnector, WebTA, Payroll, and PTS.

o Knowledge Management – Software, tools and services to create, share, use and manage business and program related knowledge in IT systems. This includes products such as

SharePoint, LinkedIn Learning, and LearningSpace.

Cybersecurity Program – represent stakeholders concerned with protecting the Agency’s information technology assets and mitigating risks associated with systems the Agency uses.

o Monitoring and Incident Management – Software, tools, and services to monitor vulnerabilities, threats, and uncertainty in IT systems and respond to cyberattacks and other incidents. This includes products such as AlienVault and IronPort.

o Risk Management – Services to manage uncertainty and mitigate threats and vulnerabilities to ensure compliance with laws, policies, and mandates. This includes Enterprise Risk

Management systems and Portfolio management systems.

Workplace Services Program – represents stakeholders who identify business needs for common information technology tools used in the office and the field.

o Customer Support – Agency and OCIO specific resources to provide technical assistance for

IT such as help desk and IT support contracts for OCIO.

o Telecom Devices – This includes smart phones, IP phones, satellite phones, and other related communications devices.

6 | P a g e o Workplace Tools – Core software applications and standard tools needed by staff such as

Word, Excel, Adobe Acrobat, and printers.

Technology Services Program – represents stakeholders who operate and maintain the Agency’s information technology systems.

o Hosting Infrastructure – Hardware, software, tools and services necessary to host and run IT systems such as servers, storage, and operating systems.

o Identity and Digital Rights Management – Software, tools, and services to identify, authenticate, and authorize individuals who use IT systems. This includes solutions such as

PIV, FICAM, and digital signatures.

o Telecom and Internet Connections – Hardware, software, tools, and services to enable communications such as the Internet, telephone lines, and networking devices.

IT Administration and Governance – OCIO administration, strategy and governance process, and office support o Administration – Resources to support training of IT staff, travel, and basic office administration.

o Governance – Software, tools, and services to support oversight and process governance of

IT programs, strategic planning, and advisory services (e.g. Gartner).

o Organization Change Management – Software, tools, and services to support organization management and agency training of IT projects and programs.

2.3 Solutions Delivery Framework

Development of IT solutions within Peace Corps are managed according to a project management process, the Solution Delivery Framework (SDF). The lifecycle begins with a New Project

Request/Business Case and ends with Close Out. Business Cases are presented to both the CIO

Leadership Council (CLC) and Technology Advisory Board (TAB), and if approved, becomes a project.

Once the project is completed, the solution delivered becomes part of the OCIO technology portfolio.

The output of the SDF is the solution itself and project artifacts. Artifacts can include a project charter, system architecture, configurations, roles, ownership, communications, training, and procedures for upgrades, patches, and change requests. TAB approved projects are developing Project Charters and

Project Management Plans that outlines high level roles and responsibilities, scope, schedule, how requirements are identified, and how the application will be developed, tested and deployed.

OCIO Office Directors and staff play an important and active role in the SDF.

Assign project team members

Review/Edit/Approve project artifacts

Actively participate in OCIO CLC Meetings and Project Gate Reviews

A RACI matrix outlines Director roles in the process

Project Gates and the CIO Leadership Council (CLC)

Project artifacts will be distributed prior to each Gate Review with the expectation that

Directors conduct a review (or delegate review) of these documents

The CLC will be the venue for Gate Reviews; Any need approvals will be electronic

7 | P a g e

SDF artifacts may also be tailored for use with the Service Management processes described below.

Often, hardware, software and service requests, and operational activities, require further elaboration and justification for evaluation by the Governance entities described below.

2.4 Approved Project Portfolio

Approved projects governed by the CLC as of Q2 FY2021.

Project Project Phase Program Area EEO Case Management 1. Request Business Operations

OHS Data Mart and Data Extraction Tool 1. Request Volunteer Lifecycle

External (peacecorps.gov) website 1. Request Business Operations

Personnel Tracking System (PTS) 1. Request Business Operations

DOVE 3.0 1. Request Volunteer Lifecycle

Telecom as a Service (telecom consolidation) 2. Initiation Technology Services

ERM System for QI and Agency 2. Initiation Volunteer Lifecycle

RPCV Portal Re-platform 2. Initiation Volunteer Lifecycle

Sunflower (future) 2. Initiation Business Operations

OHS/HIU cloud hosting and storage services 2. Initiation Volunteer Lifecycle

OSHIMS (OSHA) 2. Initiation Business Operations

FICAM Phase 1 (gap analysis/planning) 3. Planning & Requirements Technology Services

Intune (AirWatch replacement) 3. Planning & Requirements Technology Services

USA Staffing (OPM) 3. Planning & Requirements Business Operations

HR move from WebTA to Paycheck8 3. Planning & Requirements Business Operations

Post Time and Attendance Proof of Concept 3. Planning & Requirements Workplace Services

SQL Upgrades and Consolidation 4. Design Technology Services

Volunteer Portal 4. Design Volunteer Lifecycle

VRG (PCGO/VRT re-platform) 5. Development Volunteer Lifecycle

PCMEDICS 2.0 5. Development Volunteer Lifecycle

Microsoft 365 5. Development Technology Services

Certificate Management 6. Integration & Test Technology Services

SIMS (CIRS/CARS re-platform) 7. Deployment Volunteer Lifecycle

OIG-IT 7. Deployment Business Operations

GRID 7. Deployment Technology Services

GRID-SERV 4.0 7. Deployment Technology Services

Windows 2008 end of life 7. Deployment Technology Services Table 1- Approved Project Portfolio

8 | P a g e

3 Governance Governance is how decisions are made. It’s the way rules, norms and actions are structured, sustained, regulated and held accountable. Peace Corps has developed a practical governance approach to manage and align customer demand to existing capabilities. Where existing capabilities do not exist, there is a process and means to request the resources to develop new capabilities and fulfill unmet customer demand.

Governance manages customer demand through the following means.

• IgnITion Portal – The IgnITion portal is our customers’ one-stop-shop for insight into the products and services offered by OCIO for the Agency.

• Customer Catalog - includes major products supported by OCIO and a means to request new products and services.

• Service Desk Portal – Give customers insight into services requests and our service management process.

• Resource Centers – provides help and training to our customers

• Help Desk – Peace Corps’ help desk is organized around the need to support both domestic and international needs.

• SSG – The Service Strategy and Governance Group (SSG) is focused on strategic support and process. The SSG helps manage demand by working with Steering Committees and Working

Groups and fulfills the function of a Project Management Office (PMO).

• Internal OCIO – The weekly Director’s meeting and CLC help manage risk, internal activities and processes.

The governance entities established by the OCIO answer the following questions. Governance Entities are described in more detail in the next section.

Steering Committees – Is it a priority?

Service Strategy and Governance Group (SSG) – Is there a business case?

Enterprise Architecture Working Group (EAWG) – Is it an Enterprise architectural fit?

CIO Leadership Council (CLC) – Should we?

Administrative Officer (AO) – Is there money?

Office of Acquisition and Contract Management (OACM) – Can we procure it?

Information Security (InfoSec) – Does it have an acceptable level of risk?

Technical Advisory Board (TAB) – Does it align with agency objectives?

Change Control Board (CCB) – Is it deployable?

o Infrastructure Technical Review Board (TRB) – Does it fit the infrastructure architecture?

o Application Technical Review Board (TRB) – Does it fit the application architecture?

o Security Technical Review Board (TRB) – Does it fit the security architecture?

9 | P a g e

3.1 Governance Entities

There is a collection of governance entities that are responsible for overseeing the Agency’s IT investments. The composition and responsibilities of each of those entities is provided below. The figure below shows the relationship between the governance entities.

3.1.1 Technology Advisory Board (TAB)

Comprised of senior leadership to enable balanced representation during the discussion of the

Agency’s needs and priorities

Responsible for approving and prioritizing IT projects to align with the mission, strategic objectives, and budget climate of the Agency

3.1.2 Steering Committees

Steering committees will help inform business decisions related to investments in information technology. In coordination with the TAB working group, the steering committees will help prepare the quarterly TAB presentations. Steering Committees are currently in the process of forming. It is not anticipated that they will all be up and running effectively until well into

FY22.

Comprised of senior business managers and the program teams and holds a recurring meeting to track progress and arbitrate decisions

Responsible for the coordination and oversight of the Strategic Mission Support and

Management Support program clusters

3.1.3 Service Strategy and Governance (SSG)

Comprised of the team who tracks the progress of the portfolio and governs the SDF processes and artifacts

Responsible for oversight of the execution of the approved Information Technology (IT) portfolio and developing standardized processes for systems development

3.1.4 Information Security (InfoSec)

Comprised of the security team and holds meetings to review Plan of Action and Milestones

(POAMs), conduct security reviews, and provide guidance to program teams

Responsible for defining and enforcing IT security policy across the enterprise

3.1.5 Administrative Services, Administrative Officer (AO)

Comprised of the Administrative Services team who act as liaison with Chief Financial Officer

(CFO) and manage the administrative needs of CIO

Responsible for IT logistics, financial and contracts management

3.1.6 Enterprise Architecture Working Group (EAWG)

Comprised of the EA team and holds recurring meetings to develop technology standards, artifacts, and Standard Operating Procedures (SOPs)

Responsible for defining IT standards for access, data, applications, infrastructure, security and support in the enterprise based on the Federal Enterprise Architecture Framework

3.1.7 Change Control Board (CCB)

Comprised of stakeholders across CIO and holds recurring meetings to review Change Requests

(CRs)

10 | P a g e

Responsible for enforcing change control for the Agency’s production systems

Coordinates the technical and security review of Change Requests in the Technical Review Board

(TRB).

3.1.8 CIO Leadership Council (CLC)

Comprised of CIO directors and select managers and holds recurring meetings to coordinate efforts across the office and serve as a decision-making body

Responsible for the coordination and oversight of IT Programs, security, standards, projects, production systems, customer service, and budget

Figure 2 - Governance Entities and Interactions

Enterprise Architecture Policies and Procedures

Enterprise Architecture (EA) provides a framework for the management of strategic, business, technology and data decisions. The focus and scope of an EA program are dictated by the resources, culture, and commitment of an organization. For it to be successful, it needs to be clearly defined and published for all to follow.

The EAWG Charter outlines the reason for the EAWG’s existence and how it operates. It is cited in the references section along with other EA artifacts including the standards document library which contains, guidance memos, criteria for evaluation and SOPs.

11 | P a g e

12 | P a g e

4 Service Management Service management includes the processes necessary to request new capabilities, update existing capabilities and respond to incidents. While the EAWG plays an integral part in facilitating the fulfillment of service and change requests, Business and Infrastructure Services are primarily responsible for addressing incident reports. SSG provides communications support when responding to incidents.

Where appropriate, SDF artifacts are leveraged to provide the additional information necessary to evaluate and make decisions by Governance Entities.

The following are the responsible support staff for processing service and change requests.

Steering Committees

Program Managers

CORs

EAWG

CLC

Information Security

Procurement - Logistics and procurement

License Manager - License validation and management

System Management - Software testing, validation, change request and package creation

CCB - Change Control Board

Help Desk - Deployment and support

Various tools are used to manage and track service requests, change request and incident reports.

SharePoint

Track-It!

Word

Excel

PowerPoint

Outlook

Service and change requests often involve simple procurements and micro-purchases. OCIO works in coordination with both the Office of Acquisition and Contracts Management (OACM) and the requesting office to facilitate the request and ensure compliance with federal rules and regulations.

4.1 EAWG Review of Service and Change Requests

The EAWG is the authorized governance body for defining and enforcing enterprise-wide strategy, standards, policies, processes, procedures, and best practices for information technology architecture domains and service management practices. Our core objective is to take advantage of an enterprise view of the Agency’s technology to make decisions that are in the best interest of the Agency, even when that may mean turning down some individual requests.

The process associated with evaluating requests is detailed in the upcoming sections Service Request and Change Request.

13 | P a g e

4.1.1 Challenges

We have hundreds of products on our network

All products have a cost; even when software is “free”, there are costs associated with evaluating and maintaining them on our network

We receive new requests weekly to add more products to our network

Many of those hundreds of products on our network are comparable products, with only small nuances between them

When evaluating new requests, the EAWG follows the OCIO principal of reuse, before buy, before build.

We encourage customers to leverage products and services the Agency has invested in and is already supporting, to meet our customers’ business objectives. When a current product cannot meet those objectives, of all the hundreds of products we have available, it prompts a more detailed look at the product being requested:

4.1.2 EA Criteria for Review and Approval of Service Requests

Is it essential to job function?

Is it essential to direct Volunteer support?

Does it improve the safety and security of the Volunteer?

Are approved alternatives available?

Is it unique to one Post or Region of the country?

Are there budget, procurement and/or license management implications?

Are capabilities available via Shared Services or a Cloud-based solution?

Does it align with the Peace Corps information security architecture?

It is generally not in the best interest of the Agency to add unnecessary or redundant products to our network. The EAWG takes into consideration many variables. When a request is denied, there is a reasoned response.

4.1.3 EA Criteria for Review and Approval of Change Requests

The criteria below is used to evaluate if the change requested, as documented in a high-level design document, is in alignment with the existing or planned Enterprise Architecture.

Performance o How does the system align with agency strategy?

o How does the system meet federal rules/regulations?

Business o Business processes the system is supporting o Alignment with OCIO program/operating model

Data/Information o What type of information is being processed?

o Logical entity relationship diagram (ERD) to include major entities o Reference tables (standard information e.g. zip codes, states, congressional districts)

Compliance o Addresses Records Management requirements

14 | P a g e o Addresses Privacy concerns o Addresses 508 requirements

Product, Platform, System and Infrastructure Components o Use case/user interaction with system o Software and/or hardware components of system o Storage requirements o Network bandwidth/throughput requirements o Architecture diagram (for EA and InfoSec)

System boundary and location in GSS (e.g. Internal, DMZ, Post, Cloud, SaaS)

Relationship to other components of GSS and connected systems, products and/or platforms (e.g. AD, IAM, BizTalk, SQL Server, Oracle)

Machine names (VM/physical)

DNS names

IP addresses

TCP/IP ports used

Data flow and interconnects (what information flows between connected systems)

Templates and instructions here:

https://in.peacecorps.gov/HQ/OCIO/arch/Shared%20Documents/Standards/Templates https://in.peacecorps.gov/HQ/OCIO/arch/Shared%20Documents/Standards/Templates

15 | P a g e

4.2 Service Request

Following is the service request process. Service requests occur when an existing product or service does not meet customer demand and a new product or service is requested. This process covers all demand for Information and Communications technology (ICT) including hardware, software, services and projects.

Figure 3- Service Request Process

16 | P a g e

4.3 Change Request

Following is the change request process. Change requests occur when current products and services require updates to meet customer demand, ensure compliance or as part of routine maintenance. This process covers all changes to Information and Communications technology (ICT) including hardware, software, services and projects.

Figure 4 - Change Request Process

17 | P a g e

4.4 Incident Report

Following is the incident report process. An incident report occurs when there is an interruption in service or an outage related to an existing product or service.

Figure 5- Incident Report Process

18 | P a g e

5 Approved Information Technology Asset Inventory The current inventory of IT assets include both hardware and software that has been requested, evaluated and approved via the governance and service management processes described earlier. The inventory includes enterprise hardware and software, application software, FISMA systems, cloud services and products by program as of Q2 FY2021.

5.1 Enterprise Hardware and Software

Approved enterprise hardware and software assets as of Q2 FY2021 by brand and class name.

Technology Category Services AirWatch Software Enterprise Mobile Management

Amazon Web Services Software Data Center, Server Infrastructure and Systems Management

Apple iPad and iPhone Hardware Enterprise Mobile Management

Apple workstation/desktop/laptop Hardware Service Desk and Conference Rooms

AvePoint DocAve Suite Software Information and Database Management

Cireson Software Data Center, Server Infrastructure and Systems Management

Cisco Access/Distribution/Core switch Network Network and Phones

Cisco Adaptive Security Appliance Network Network and Phones

Cisco Call Center Express Software Network and Phones

Cisco Call Manager Software Network and Phones

Cisco ISE Software Network and Phones

Cisco Media Convergence Server (MCS) Network Network and Phones

Cisco Router Network Network and Phones

Cisco Unified Computing System (UCS) Hardware Network and Phones

Cisco UNITY Software Network and Phones

Cisco Voice Gateway Network Network and Phones

Cisco Wide Area Application Services

(WAAS)

Network Network and Phones

Cisco Wireless solution Network Network and Phones

CommVault backup and recovery Software Backup and Disaster Recovery

CyberArk Privileged Account Security Software Security Engineering

Gigamon Network Network and Phones

HP enterprise server equipment Hardware Data Center, Server Infrastructure and Systems Management

HP workstation/desktop/laptop Hardware Service Desk and Conference Rooms

Infoblox DNS Network Network and Phones

Ipswitch MOVEit Managed File Transfer/SFTP

Software Information and Database Management

Joomla Content Management System Software Information and Database Management

Kemp load balancer Network Network and Phones

Lenovo workstation/desktop/laptop Hardware Service Desk and Conference Rooms

19 | P a g e

Microsoft .Net, C# Development Software Services

Microsoft Active Directory, including group-policy

Software Identity and Access Management (IAM)

Microsoft Azure and Cloud Services Software Active Directory, Application Proxy, Development, Backup and Disaster Recovery

Microsoft BizTalk Software Information and Database Management

Microsoft BizTalk Development Information and Database Management

Microsoft Dynamics CRM Software Information and Database Management

Microsoft Dynamics CRM Development Information and Database Management

Microsoft Exchange Software Messaging and Communications

Microsoft Hyper-V Software Data Center, Server Infrastructure and Systems Management

Microsoft Hyper-V Development Data Center, Server Infrastructure and Systems Management

Microsoft Identity Manager (MIM) Software Identity and Access Management (IAM)

Microsoft InTune Software Enterprise Mobile Management

Microsoft SharePoint Software Information and Database Management

Microsoft SharePoint Development Information and Database Management

Microsoft Skype for Business Software Messaging and Communications

Microsoft SQL Server Software Information and Database Management

Microsoft SQL server Development Information and Database Management

Microsoft Surface Pro Hardware Enterprise Mobile Management

Microsoft System Center Software Data Center, Server Infrastructure and Systems Management

Microsoft System Center Development Data Center, Server Infrastructure and Systems Management

Microsoft Team Foundation Server Development Information and Database Management

Microsoft Visual Studio Development Software Services

Microsoft Visual Studio Testing Center Development Software Services

Microsoft Windows Desktop Operating Systems

Software Service Desk and Conference Rooms

Microsoft Windows Server Software Data Center, Server Infrastructure and Systems Management

NetApp/ONTAP Hardware Data Center, Server Infrastructure and Systems Management

Oracle Database Software Information and Database Management

Oracle Database Development Information and Database Management

Oracle Linux Software Data Center, Server Infrastructure and Systems Management

Oracle VM Software Data Center, Server Infrastructure and Systems Management

Paessler PRTG Software Network and Phones

Palo Alto network equipment Network Network and Phones

20 | P a g e

Plixer Scrutinizer Software Network and Phones

Portable satellite phones Network Network and Phones

RSA two-factor authentication Software Identity and Access Management (IAM)

Samsung Galaxy and Android OS Hardware Enterprise Mobile Management

SolarWinds (NCM & VNQM) Software Network and Phones

Very Small Aperture Terminal (VSAT) satellite data connection

Network Network and Phones

VMWare ESX Software Data Center, Server Infrastructure and Systems Management

VMWare View/VDI Software Data Center, Server Infrastructure and Systems Management

Zoom Software Video telephony and online chat services Table 2 - Enterprise Hardware and Software

5.2 Application Software

Currently approved and installed application software assets as of Q2 FY2021.

Vendor and Applications Count

1099Express 1

W-2 Express Enterprise 1

1E 7

1E Catalog 2

ActiveEfficiency Scout 1

ActiveEfficiency Server 1

AppClarity 3

ABBYY 58

ABBYY Lingvo 12 Three Languages 55

ABBYY Lingvo x6 1

Lingvo 2

ADI Global Distribution 1

WIN-PAK 1

Adobe Systems Incorporated 4203

Acrobat 178

Acrobat Customization Wizard 1

Acrobat Reader 3466

After Effects 22

Audition 4

Bridge 3

Captivate 12

Creative Cloud 69

Flash Player ActiveX 2

Flash Player PPAPI (required for legacy applications) 1

Illustrator 102

InDesign 74

21 | P a g e

Lightroom 26

Media Encoder 6

Photoshop 140

Premiere Pro 75

Premiere Pro CC (2018) 22

Alpha Zawgyi 15

Unicode System 15

AMGtime 4

AMG Attendance System 4

Araxis Ltd 8

Merge 8

Articulate Global, Inc. 4

Storyline 4

Audacity 4

Audacity 4

Avenir Health 1

Spectrum 1

AvePoint, Inc. 12

Compliance Guardian Manager 4

DocAve 6 Manager for SharePoint 1

DocAve Agent Service for SharePoint 6

Governance Automation for SharePoint 1

BMC Software, Inc. 3

Track-It! 3

Brice Lambson 4

Image Resizer 4

Bureau of the Fiscal Service 7

OTCnet Firmware 4

OTCnet OLB 3

Canon 1

CapturePerfect 1

Centers for Disease Control and Prevention 3

Epi Info 3

Cerberus, LLC 2

FTP Server 2

CERENADE 4

Cerenade Filler 4

Circle Systems, Inc. 1

Stat/Transfer 1

Cisco Systems, Inc. 167

AnyConnect Secure Mobility Client 36

CiscoVirtualCom(x64) 76

EAP-FAST Module 2

22 | P a g e

IP Communicator 42

LEAP Module 2

PEAP Module 2

WebEx 6

WebEx Meetings 1

Citrix Systems, Inc. 72

Authentication Manager 11

Connection Manager 9

HDX Engine 9

Receiver 3

Receiver Inside 3

Screen Casting for Windows 7

WorkSpace 22

WorkSpace Browser 8

Commvault 140

Active Directory iDataAgent 7

Analytics Instance 2

Cloud Connector 1

CommServe 2

CommServeFailover Instance002 2

CommVault Base Client (Instance001) 1

ContentStore 30

Diagnostics And Usage Server 2

Exchange Database iDataAgent 4

ExchangeOfflineMiningTool 1

Hardware VSS Provider 7

IndexingServer Instance001 1

IntelliSnap 4

MediaAgent 7

MediaAgentCore 7

Message Queue 2

SharePoint Server iDataAgent 3

SQL Server iDataAgent 6

Virtual Server Agent 7

VSS Provider 7

Web Console 2

Web Server 2

Windows File System iDataAgent 31

WorkFlow Engine 2

Compusearch Software Inc. 76

CoExistSetup 6

Crystal Report Generator For PRISM 6

CSSPrismNetSetup 6

23 | P a g e

CSSReleaseNet_Setup 6

CssSecureNet 6

CSSVIPMonitorNet 4

Export Jobs 6

FedConnectClientsSetup 6

Infomentum ActiveFile 6

NGTransSetup 3

PDFExport DLL 6

PDFExportNet 3

PRISM Application Extension 6

PRISM Crystal XI Application Extension 6

Corel Corporation 5

MindManager 1

Self-Extractor 1

WinZip 3

CSS 9

CSSMail 3

PrismNet WarmUp Service 6

CyberArk Software Ltd. 6

Central Policy Manager 1

CyberArk Privileged Session Manager 1

Password Vault Web Access 2

PrivateArk Client 1

Replicator 1

Dolby Laboratories, Inc. 524

Dolby Audio 524

Don Ho 30

Notepad++ 30

Erlang Solutions Ltd 1

OTP 18 1

F5 Networks, Inc. 4

BIG-IP Edge Client 4

Flexera Software LLC. 8

AdminStudio 1

AdminStudio Application Isolation Wizard 1

AdminStudio Application Management 1

AdminStudio Application Virtualization and Repackaging 1

AdminStudio Process Template Editor 1

AdminStudio QualityMonitor 1

AdminStudio Tuner 1

WiseScript Package Editor 1

Freedom Scientific, Inc. 43

Authorization 3

24 | P a g e

Braille 3

CommandsSearcher 3

Document Server 2

Elevation 3

Error Reporting 5

FSOcrTombstone 3

FSReader 3

FSRibbonSrv 3

Fusion Interface 3

JAWS 6

JAWS Start 3

JAWS Training Table Of Contents DAISY Files 3

FUJITSU 38

CardMinder 2

ScanSnap 3

ScanSnap Manager 31

ScanSnap Organizer 2

Google 8277

Chrome 7079

Earth 1198

Hewlett-Packard 6

Solution Center 6

IBM Corporation 11

SPSS Statistics 11

Inmarsat Government 1

IsatPhone 2 firmware upgrade tool 1

Insecure.org 3

Nmap 3

Intel Corporation 2320

Management Engine Components 6

Processor Graphics 2019

PROSet/Wireless Software 143

PROSet/Wireless WiFi Software 141

Rapid Storage Technology 11

Ipswitch, Inc 71

MOVEit Central 1

MOVEit Central Admin 1

MOVEit DMZ API 67

WS FTP 2

JAM Software 5

TreeSize 5

Kofax Inc. 5

Kofax VRS 5

25 | P a g e

Lenovo 869

Active Protection System 868

Cloud Deploy 1

LSoft.net 5

Active@ KillDisk 5

Martin Prikryl 11

WinSCP 11

Massachusetts Institute of Technology 1

Kerberos 1

McAfee LLC 13

Endpoint Security Firewall 3

Endpoint Security Platform 3

Endpoint Security Threat Prevention 3

Endpoint Security Web Control 3 ePolicy Orchestrator 1

McKesson Corporation 2

CSOS Directories 2

Mendeley Ltd. 2

Mendeley Desktop 2

Mersive 2

Solstice 2

Micro Focus 2

WebInspect 2

Microsoft Corporation 16462

.NET Core 42

Access 1

Baseline Security Analyzer 37

IIS 1

Internet Explorer 4704

Internet Information Services 14

Lync 1

Office 3512

OneNote 1

Power BI Desktop 5

Power Query for Excel 7

PowerPoint 1

PowerPoint Services 5

Project 74

Publisher 1

SharePoint Designer 67

Silverlight 4117

SQL Server Data Tools 14

SQL Server Management Studio 34

26 | P a g e

SQL Server Report Builder 1

Test Tools for Visual Studio 10

Visio 176

Visio Viewer 3497

Visual Studio 28

Windows Mobile Device Center 112

Mobatek 24

MobaXterm 24

MongoDB, Inc. 2

MongoDatabase Instance 2

Mozilla 8

Firefox 4

Maintenance Service 4

NetBrain Technologies, Inc. 4

Cache Server 1

NetBrain Integrated Edition 1

NetBrain Message Server 1

NetBrain Proxy Server 1

Neumetrix Limited 1

HttpWatch 1

Newell Brands 14

DYMO Label 14

Nmap Project 27

Npcap 27

Nuance Communications, Inc. 52

OneTouch 52

NVIDIA Corporation 3

Control Panel 3

OpenText Corp. 4

Exceed onDemand 2

Hummingbird Component Deployment 1

Hummingbird Exceed onDemand Client 1

Oracle Corporation 311

BI Publisher Desktop 2

EPM System 3

Financial Reporting Studio 1

Hyperion Smart View for Office 253

Instant Client 3

Java 44

User Productivity Kit 5

OSSEC 249

HIDS 244

Hids Agent 5

27 | P a g e

Paessler AG 38

PRTG Network Monitor 38

Palo Alto Networks 2243

GlobalProtect 2243

Peace Corps 286

FACTS Info 1

Gotham Condensed Font Pack 14

Gotham Narrow Font Pack 9

PC Apps 227

PCVCongressionalDistrictMapper 2

PeaceCorps.BizTalk.AgencyCRM for BizTalk 2

PeaceCorps.BizTalk.Common for BizTalk 3

PeaceCorps.BizTalk.DOVE for BizTalk 2

PeaceCorps.BizTalk.DOVE-Odyssey for BizTalk 3

PeaceCorps.BizTalk.GSA for BizTalk 3

PeaceCorps.BizTalk.LMS for BizTalk 1

PeaceCorps.BizTalk.MAXx for BizTalk 2

PeaceCorps.BizTalk.PCVDBMS for BizTalk 3

PeaceCorps.BizTalk.Sunflower Application 1

PeaceCorps.CARS.BizTalk.CIRS for BizTalk 2

PeaceCorps.CARS.BizTalk.Common for BizTalk 2

PeaceCorps.CARS.BizTalk.CRM for BizTalk 2

PeaceCorps.ESB.CRM.Integrations 3

PeaceCorps.ESB.Kenexa.Integrations for BizTalk 2

USPS Zip Code Validator 2

Plenom 54

Busylight 42

Kuando Busylight and KuandoBox for Skype for Business 12

PortSwigger Ltd. 1

Burp Suite Community Edition 2.1 1

Progress Software Corporation 3

Fiddler 3

Python Software Foundation 5

Python 5

QGIS Development Team 19

QGIS 1

QGIS Las Palmas 18

QSR International Pty Ltd. 8

NVivo 8

Quest Software Inc. 42

Toad for Oracle 42

R Core Team 41

R for Windows 41

28 | P a g e

Riverbed Technology 133

WinPcap 133

RStudio 38

RStudio commercial 38

SAMSUNG 1

Smart Switch 1

SAP 106

Crystal Reports .NET Server 99

Crystal Reports Runtime 1

Crystal Reports runtime engine for .NET Framework 6

Sase Sham 3319

Wireless AutoSwitch XPV 3319

Schneider Electric 164

APC Device IP Configuration Wizard 1

PowerChute 1

PowerChute Business Edition Agent 3

PowerChute Network Shutdown 159

Sharegate 6

Sharegate 1

Sharegate Extension 5

SHARP 2

Sharpdesk 2

Sierra Wireless 698

Sierra Wireless EM7340 4G LTE Software 375

Sierra Wireless EM7345 4G LTE Software 323

Simon Tatham 49

PuTTY 49

SolarWinds Worldwide, LLC. 2

High Availability 2

StataCorp 2

Stata 2

Sunflower Systems 159

Synclink 159

Symantec Corporation 49

Backup Exec 33

Symantec Backup Exec (Feature Pack 4) 16

Systems Management Engineering, Inc. 90

Aquifer 46

Aquifer Client 44

Tableau Software 1681

Tableau Desktop 29

Tableau Reader 1652

TechSmith Corporation 117

29 | P a g e

Camtasia Studio 19

Snagit 98

Tenable, Inc. 3466

Nessus 10

Nessus (x64) 1

Nessus Agent 3382

Nessus Agent (64) 3

Nessus Network Monitor 70

U. S. Department of State 1

COAST 1

Uplinx Software Pty Ltd 1

Uplinx Remote Phone Control Tool 1

USAccess 13

CyberArmed BioAdaptor Configure Utility (Suprema) 3

Network Test Tool 1

System Info 3

USAccess CMS ActiveX Controls 3

USAccess Suprema BSP (x64) 3

VanDyke Software, Inc. 11

SecureCRT 11

Veritas Technologies LLC 271

Veritas Backup Exec 271

Visioneer 38

OneTouch 38

VMware, Inc 370

AirWatch Content Gateway 1

AirWatch Tunnel Proxy 1

Certificate Service 1 cis-upgrade-runner 1

VMware Tools 361 vSphere Client 5

WinSCP.net 3

WinSCP 3

Wireshark Foundation 19

Wireshark 19

Zebra 1

CardStudio 1

Zoho Corporation Pvt. Ltd. 2

ADAudit Plus 1

ADManager Plus Free Tools 1

Grand Total 47,785 Table 3 - Application Software Asset inventory

30 | P a g e

31 | P a g e

5.3 FISMA Systems

The following are the identified FISMA systems as of Q2 FY2021

CSAM ID Org System Name Acronym Category 6 OCFO Financial Services FIN Moderate

23 OCIO Peace Corps Network Services System PCNSS Moderate

25 OCIO Peace Corps Core Services System PCCSS Moderate

45 OCIO Peace Corps General Support System PCGSS Moderate

4 OCIO Global Support System GSS Moderate

14 OCIO Peacecorps.gov PCGOV Moderate

24 OCIO Peace Corps Platform Services System PCPSS Moderate

27 OCIO Agency Customer Relationship Management (CRM) Agency CRM Moderate

21 OCIO Peace Corps Security Operations Center PCSOC Moderate

12 OCIO Cyber Security Assessment and Management CSAM Moderate

37 OCIO Personnel Tracking System PTS Moderate

3 OGO Global Operations GOPS Moderate

38 OHS Medical Applicant Exchange MAXx Moderate

40 OHS PC Medical Electronic Documentation & Inventory Control System

PCMEDICS 1.x Moderate

42 OHS PC Medical Electronic Documentation & Inventory Control System (PCMEDICS 1.5)

PCMEDICS 1.5 Moderate

22 OM Sunflower Enterprise System SES Low

50 OM FOIAXpress PAL FOIA Moderate

26 OM Career Connector CareerConnector Moderate

36 OM WebTA WebTA Moderate

41 OPATS Learning Management System LMS Low

53 S&S Peace Corps Emergency Notification System PCENS Low

32 S&S Consolidated Incident Reporting System CIRS Moderate

5 S&S Safety & Security SS Moderate

51 S&S PCCATS SaaS PCCATS Moderate

1 VRS Volunteer Delivery VDS Moderate Table 4 - FISMA Systems

32 | P a g e

5.3.1 Boundary Realignment Future State FY22-23

Improved FISMA system boundary criteria have been developed to rationalize the current inventory.

System Boundaries will be based upon information types with similar mission and business function.

Each service (application) will be considered a component within the system boundary. System Owners will be identified for all systems as individuals who have the authority to ensure commitments are met and reflect the overall Office priorities for all components. Ideally, this should be divisional Deputy

Directors. The result of the boundary realignment will be reduced cost due to the consolidation of systems that will align risk to the office’s mission, thereby making management sustainable given the available resources.

The following are the notional new FISMA system boundaries.

Office of Chief Financial Officer Systems o Financial Services (6)

Office of the Director o RPCV (13) o Director’s Correspondence (TBD)

CIO - Information Assurance Inventory o Security Monitoring Services (21)

Network Vulnerability Monitoring

WebApp Vulnerability Monitoring

Database Vulnerability Monitoring

Security Information & event Monitoring o CSAM (12) o Common Controls program (10)

Security Governance

Enterprise Architecture

Privacy Controls

Safety & Security Controls

CIO - Infrastructure Services o Global Support System (45)

Network Services

Platform Services

Core Software

Customer Support

Office 365

CIO - Business Services o Business Application Services (66)

PC Dynamics

PC SharePoint

External Affairs Inventory o PCGOV EA Services (14)

Office of Global Operations o Global Operations (3)

VIDA

33 | P a g e

VRG

PCLIVE

Office of Health Services o Health Service System (66)

MAXx

PCMEDICS

Office of Management o Management Services (66)

FOIA

LMS - Learning Management

SES - Asset Management

Office of Safety & Security o Safety & Security Services (44)

Safety Incident Management

Adjudication Tracking (PCCATS) o Guardian (TBD)

Volunteer Recruiting & Selection o Volunteer Recruiting & Selection Services (1)

VDS – DOVE

PCrm o HireVue (TBD)

Human Resources o Human Capital System

Career Connector (26)

FHRNavigator (58) eOPF (56)

USAJobs (25)

WebTA (36)

34 | P a g e

5.4 Cloud Services

The following are the identified Cloud Services as of Q2 FY2021

Cloud Service Provider

Cloud Service Offering Service Service Type

(The Economist)

CQ/RC

Congressional Quarterly/Roll Call

Tracking legislation, policy, advocacy (Subscription/Account)

SaaS

(Vendor to) Department of State

DriveCam Coaching/driving tool for drivers (Subscription/Account)

Shared Service

AINS MicroPact Product Suite

Software as a Service for FOIAXpress and PCCATS

SaaS

Amazon AWS US East/West

Infrastructure for LMS, PCGOV IaaS/PaaS army.mil FAITAS Tracks COR status, approvals, training.

Mandated under OFPP Act (OMB) and administered by GSA (Subscription/Account)

Shared Service

Avue Avue Retention of records for staff recruitment and hiring

SaaS

AWS

(peacecorps.gov)

PeaceCorps.gov Public website

Infrastructure/ Website Hosting IaaS

BaseCamp BaseCamp Idea Management, Project Management (Subscription/Account)

SaaS

Brand Central Brand Central Digital Asset Management SaaS

Microsoft Recruitment via LinkedIn

Recruitment outreach SaaS

Click Dimensions (PCrm, a component in Agency CRM)

Leads & Marketing Tracking

Recruitment & Marketing SaaS

Coursera Coursera Digital Educational Content SaaS

Department of State SHIFTS Move payroll, disbursing, and accounting data files to or/from federal Comptroller and Global Financial Services (CGFS). (Subscription/Account)

Shared Service

Department of Treasury

Pacer Online portal to confirm payments to individuals and other federal agency stakes in payment.

(Subscription/Account)

Shared Service

Department of Treasury

IPAC Move money from one Federal agency to another (Subscription/Account)

Shared Service

Department of Treasury

MoveIt Move files from PC to Treasury (Subscription/Account)

Shared Service

Department of Treasury

OTCNet Local Bridge (OLB)

Support check processing and check capture tasks (Subscription/Account)

Shared Service

DOE/INL (Battel Energy)

VMIS Vehicle Management Information Systems

SaaS

35 | P a g e

Economic Systems Economic Systems Federal Human Resources Navigator

Software as a Service for EconSys SaaS e-Think e-Think LMS (Learning Space)

Learning Management System SaaS

Everbridge Everbridge Suite Software as a Service for PCENS SaaS

Everbridge Everbridge Emergency Notifications

Emergency Notifications SaaS

FOIA FOIA Case Management

Case Management SaaS

Foundation Center Foundation Center Fundraising info and resources (Subscription/Account)

SaaS

HireVue HireVue HireVue SaaS

IBM IBM/Kenexa (DOVE 2.x)

Volunteer Recruiting SaaS

IRS 1099s and W-2s Creates 1099s and stores W-2s (Subscription/Account)

Shared Service

Libib, Inc. Libib Mobile Apps & Service

Digital Asset Management SaaS

Lookout, Inc. Lookout Mobile Apps & Service

Mobile Device Security SaaS

Microsoft Office 365 Email and collaboration solutions IaaS

Microsoft Azure IaaS Infrastructure for Application Development, Testing and Demonstrating PCMEDICS Cloud hosting environment

IaaS

Microsoft LinkedIn Learning Digital Educational Content SaaS

Monster (Dept of Treasury)

Career Connector Staff Recruitment and Hiring SaaS

NARA ARCIS, ERA Facilitates transfer/assessioning (sending permanent records to the National Archives) of records (Subscription/Account)

Shared Service

Office of Government Ethics

Integrity Public Financial Disclosure Reports

(OGE-278)

Shared Service

OPM EOPF Federal Shared Service for Electronic Official Personnel Folder

SaaS

OPM OPM Alert Mobile App & Service

OPM operating status alerts SaaS

Social Media accounts (FB, Twitter, Flickr, Instagram, Pinterest, YouTube, Tumblr)

Social Media Marketing, public information sharing (Subscription/Account)

SaaS

36 | P a g e

SpringShare LibGuides Web Publishing and Content Curation SaaS

Survey Monkey Surveys Survey request and response (Subscription/Account)

SaaS

UpToDate, Inc. UpToDate Mobile Apps & Service

Clinical Decision Support SaaS

US Army Financial Disclosure Management

(FDM)

Used by GC for onboarding staff required to disclose financial interests

Shared Service

USDA/NFC Enterprise Payroll Federal Shared Service for Enterprise Personnel and Payroll

SaaS

USDA/NFC webTA (Web-based Time and Attendance)

Federal Shared Service for Time and Attendance Tracking

SaaS

USPS-OIG Data independence

Email and file share solution and management

IaaS

Vertex Vertex Address Verification

Pinpoints tax jurisdictions, applies standardization (Subscription/Account)

SaaS

Virtual Acquisition Office

Virtual Acquisition Office

Subscription based service for acquisition related information (Subscription/Account)

SaaS

WestLaw WestLaw Case Law Info (Subscription/Account) SaaS

Zenfolio Zenfolio Digital Asset Management SaaS

Zoom Zoom Conferencing SaaS Table 5 - Cloud Services

37 | P a g e

5.5 Product Portfolio by Program

Peace Corps products are either configured SaaS or internally developed solutions based upon our

Enterprise software standards and supported platforms. Each program has their own portfolio of products aligned to the needs of their customers and lines of business.

5.5.1 Volunteer Lifecycle

The following products support the recruitment, placement and support of Volunteers before, during and after service.

Product Vendor Product Category

Product Description

Agency CRM Microsoft In-Service/At-Post The Peace Corps has 3 customized instances of the Microsoft Dynamics platform - Agency CRM, MAXx, and PCGO. The Agency CRM instance includes a number of component Business Products such as VIDA, SIMS, PCrm

Case Management System

Peace Corps Health & Safety The Case Management System is used to track Medevac and other types of medical cases that may occur during a Volunteer's service. This system also tracks medical appointments and diagnoses, and it will issue Authorizations for payment.

Close of Service Evaluation

Peace Corps Health & Safety This application is used to record the finding of the health record review that is performed for each Volunteer whenever they close service.

CRM for Office of Third Goal

Peace Corps Pre-Service/Post- Service

CRM for the Office of Third Goal, or 3GL, allows the Office of Third Goal and Returned Volunteer Services to track their relationships with various stakeholders, including RPCVs who communicate through the RPCV Portal, career fair employers, and World-Wise School partners. It also provides staff in the Office of Third Goal the ability to manage RPCV requests and inquiries that come through the RPCV Portal.

DOVE IBM Pre-Service/Post- Service

Tool used for managing volunteer positions and applicants including

38 | P a g e placement, evaluation and onboarding.

Health Record Management System

Peace Corps Health & Safety This application is used by the Office of Medical Services, Medical Records Units, to process electronic requests for a volunteer's health record and provides the ability to request health records from the Federal Records Center or Post.

MAXx - Medical Applicant Exchange

Peace Corps Pre-Service/Post- Service

Business Product for managing pre-service medical screenings.

PCGO - Peace Corps Grants Online

Peace Corps In-Service/At-Post Business Product that allows Peace Corps staff to manage the full small grant lifecycle, including management of the projects funded by grants.

PCMEDICS - Peace Corps MEDICS

Peace Corps Health & Safety The Peace Corps' electronic health record management system.

PCrm - Peace Corps Recruitment and Marketing

Peace Corps / ClickDimensions

Pr…