Directive_6404_23_Feb_2016.pdf

Department of Veterans Affairs VA DIRECTIVE 6404 Washington, DC 20420 Transmittal Sheet February 23, 2016

VA SYSTEMS INVENTORY (VASI)

1. REASON FOR ISSUE: This Directive establishes the Department of Veteran Affairs (VA) Systems Inventory (VASI) as the authoritative source for VA Information Technology (IT) Systems and defines the objectives, principles, roles and responsibilities for the utilization, management and sustainment of the VA Systems Inventory. Full implementation of this policy is necessary to manage current capabilities, prevent duplicative development efforts and facilitate future planning resulting in efficient and effective use of VA resources to deliver an integrated and interoperable information environment.

2. SUMMARY OF CONTENTS: This Directive:

a. Establishes VASI as the authoritative data source (ADS) for VA IT Systems. VASI will aggregate identifying and descriptive information of VA IT Systems for the purpose of creating and maintaining a department level authoritative Systems Inventory.

b. Establishes VA organizational roles and responsibilities regarding the use and management of VASI and the information contained within. Implementation of and compliance with this policy is a shared responsibility amongst all VA Administrations and staff offices including the Office of Information and Technology (OI&T).

3. RESPONSIBLE OFFICE: Office of Information and Technology (005).

4. RELATED DIRECTIVES: None.

5. RESCISSIONS: None.

CERTIFIED BY:

/s/ LaVerne H Council Assistant Secretary for Information and Technology and Chief Information Officer Office of Information and Technology

BY DIRECTION OF THE SECRETARY

OF VETERANS AFFAIRS:

/s/ LaVerne H Council Assistant Secretary for Information and Technology and Chief Information Officer Office of Information and Technology

Distribution: Electronic Only

THIS PAGE INTENTIONALLY LEFT BLANK

February 23, 2016 VA DIRECTIVE 6404

VA SYSTEMS INVENTORY (VASI)

1. PURPOSE. This Directive establishes the VA Systems Inventory (VASI) as the authoritative data source (ADS) for VA IT Systems and defines the objectives and principles behind its management and utilization. VASI is a vital component of the Department’s Enterprise Architecture (EA). It provides a Department-wide inventory of systems and systems related information that reflects the current state of the VA’s information environment. Through the EA, VASI links systems information to other information about VA’s business and IT environment, enabling analysis and decision support across a wide variety of topics. This policy will enable the Department to accomplish the following:

a. Establish a common understanding of Systems and key System related terms.

b. Uniquely identify VA IT Systems across the agency.

c. Facilitate validation and management of the descriptive information captured over the life of a VA IT System and enable search and discovery of related descriptive information.

d. Document capabilities and functions currently delivered by VA IT Systems.

e. Provide a means to document the relationships between VA IT Systems and other key information sources (e.g. VA strategies, capabilities, business functions, technical infrastructure, security etc.). In addition, deliver an integrated view of System information including data residing in other enterprise repositories.

f. Improve accuracy and efficiency of system-centric reporting.

g. Provide timely system related information to VA leadership in order to improve decision support capabilities.

2. POLICY.

a. VASI is recognized as the Department’s authoritative data source for information used to identify and describe VA IT Systems.

b. Any VA business capability that meet the following criteria will be registered in VASI: (These criteria are depicted in Appendix A)

(1) Contains a combination of IT hardware, software, or information management capabilities

(2) Is funded and operationally managed by the VA

VA DIRECTIVE 6404 February 23, 2016

(3) Is hosted in a shared computing environment (e.g., data center, cloud facility, medical center)

(4) Is not an infrastructure or software sub-component (e.g., servers, network routers, storage) required to support a System

(5) Is not a Medical Device (e.g., cardiology equipment, medical lasers, endoscope) categorized under VA Medical Device Nomenclature System (MDNS) and governed by Medical Device Isolation Architecture (MDIA)

c. Validating system information in VASI is a requirement for any VA reviews associated with defining, building, enhancing, certifying, operating or retiring VA

IT Systems.

d. All data stores and associated data schemas associated with systems registered in VASI shall be registered in the VA Enterprise Architecture (VA EA).

e. VASI is a component of the overall integrated VA EA. VASI shall be bound by the same access procedures and specifications that are applicable to the overall integrated VA EA.

3. RESPONSIBILITIES.

a. Office of Information and Technology (OI&T) is responsible for the development and sustainment of VASI as well as ensuring compliance of development and monitoring processes that enable capture of complete and accurate information in VASI. The OI&T organizations below have the following responsibilities related to VASI:

(1) Architecture, Strategy and Design (ASD)

(a) Lead the overall implementation of VASI. Drive the development, maintenance and adoption of VASI via enterprise wide collaboration.

(b) Responsible for requirements, design, engineering and maintenance of

VASI.

(c) Provide guidance and training to VASI stakeholders on the usage of VASI

(d) Oversee the maturation and increased quality of the VASI content (e.g.

addition of system interface details) to improve usefulness.

(e) Report compliance with this policy and VASI performance metrics for the

OI&T Operational Performance Report (OPR) monthly status reporting.

(2) Service Delivery and Engineering (SDE)

(a) Confirm accurate registration in VASI for any capabilities (meeting VASI System Identification Criteria depicted in Figure 1) SDE oversees or manages.

(b) Ensure Stakeholder Information (e.g. Programmatic System Owner, Operations Manager, Technical POC, and FISMA System Owner), Hosting Locations and Critical Technologies are complete, accurate and current for all Systems hosted and operationally managed by SDE.

(c) Ensure VASI information is updated or validated during operational assessments or any VA IT System reviews (e.g. Systems Engineering and Design Reviews (SEDR) or Operational Assessments (OAs)) conducted by SDE.

(d) Develop and implement a process to ensure alignment of IT Infrastructure and Configuration Items (currently captured in the SDE Configuration Management Database (CMDB)) with the applicable VASI Systems.

(e) Develop and implement a process to ensure alignment of Web Site

Information (currently captured in VA Web Registry) with the applicable VASI Systems.

(f) Develop and implement a process in coordination with ASD and the business sponsor to ensure physical data schema(s) associated with VASI systems operationally managed by SDE are registered in the VA Enterprise Architecture (VA EA).

(3) Product Development (PD)

(a) Confirm accurate registration in VASI for any capabilities (meeting VASI

System Identification Criteria depicted in Figure 1) PD oversees or manages.

(b) Ensure Stakeholder Information (e.g. Project Manager) and Project mappings are complete, accurate and current for all applicable VASI Systems.

(c) Ensure VASI information is updated or validated during VA IT System reviews (e.g. PMAS Milestone Reviews) conducted by PD.

(d) Develop and implement a process in coordination with ASD to ensure alignment of VA Project information (currently captured in PMAS Dashboard) with the applicable VASI Systems.

(e) Develop and implement a process in coordination with ASD and the business sponsor to ensure physical data schema(s) associated with VASI systems operationally managed or actively developed by PD are registered in the VA Enterprise Architecture (VA EA).

(4) Office of Information Security (OIS)

(a) Ensure System Security Accreditation Boundary mappings are complete, accurate and current for all VASI Systems.

(b) Develop and implement a process in coordination with ASD to ensure alignment of Security Accreditation Boundary information (currently captured in the Governance Risk and Compliance (GRC) RiskVision) with VASI Systems.

(5) Information Technology Resource Management (ITRM)

(a) Ensure OMB IT Investment Code mappings are complete, accurate and current for all VASI Systems.

(b) Develop and implement a process in coordination with ASD to ensure alignment of funding information (currently captured in the Budget Tracking Tool (BTT)) with VASI Systems.

b. Administrations & staff offices. In execution of their mission responsibilities

VA Administrations and staff offices shall:

(1) Confirm VASI registration for VA IT Systems (meeting VASI System Identification Criteria depicted in Figure 1) supporting administration and staff office business capabilities or functions.

(2) Ensure System Description, System Criticality (a business perspective on impact of System failure), Stakeholder Information (e.g. Business Sponsor, and Data Steward), Sponsor Organization, VA Capability, Business Function and Business Process mappings are accurate and current in VASI.

(3) Ensure VASI information is updated or validated during VA IT System reviews.

(4) Support ASD efforts to gather System Interface information to accurately reflect System dependencies and business transactions.

(5) Ensure compliance with this policy within decision and governance processes as appropriate.

c. Office of Inspector General. Due to the Office of Inspector General's (OIG) statutory independence, including independent IT appropriation, the requirements in this Directive do not apply to OIG.

4. REFERENCES.

a. VA Directive 6518, Enterprise Information Management, February 20, 2015.

b. VA Directive 6071, Project Management Accountability System, February 20, 2013.

c. VA Memorandum, Enterprise Technical Architecture Compliance Criteria Guidance, September 17, 2012.

d. The Federal Information Security Modernization Act of 2014 (FISMA).

e. OMB M-10-06, Open Government Directive, December 8, 2009.

f. OMB M-12-18, Managing Government Records Directive, August 24, 2012.

g. President Executive Order, Making Open and Machine Readable the New Default for Government Information, May 9, 2013.

h. OMB M-13-13, Open Data Policy- Managing Information as an Asset, May 9, 2013.

i. FY 2015 CIO Annual FISMA Metrics.

j. VA Memorandum - Isolation Architecture for Networked Medical Devices (WebCIMS 453293).

k. Medical Device Isolation Architecture (MDIA) 2015 Guidance, Version 7.0.

5. DEFINITIONS.

a. Authoritative Data Source (ADS). A source of data or information designated and recognized as official that is trusted, timely, secure and used within VA’s information environment in support of VA business processes. Administrations and Staff Offices designate these sources within domains for which they are the stewards. The Office of Information and Technology develops and maintains technology solutions (e.g. services) that use these sources.

b. Capability. The ability to achieve a desired effect under specified [performance] standards and conditions through a combination of ways and means [activities and resources] to perform a set of activities.

c. Data Store. A place where data is stored; data at rest. A generic term that includes databases and sets of flat files.

d. Physical Data Schema. Describes how data is to be represented and stored in a Data Store.

e. Information Environment. The aggregate of the information created and used by an organization, the information architecture of the organization (models, authoritative and redundant data stores, data flows), and the governance framework, policies and standards that ensure information is managed as an asset.

f. Investment Code. The distinct title of an entry or investment as it appears on a separate line in a fiscal budget.

g. Security Accreditation. The characterization of information or an Information System based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information System would have on organizational operations, organizational assets, or individuals.

h. System. An interconnected set of information resources under the same direct management control, which shares common functionality. A System normally includes hardware, software, information, data, applications, communications, and people.

i. Business System. A methodical procedure, process or capability that is used as a delivery mechanism for providing specific goods or services to customers.

j. System Centric. Attributes and measures defined in relation to Systems.

k. VA Customers. Military Service members, Veterans, and their beneficiaries and representatives.

l. Medical Device. Any device that meets any of the following requirements:

If it is used in patient healthcare for diagnoses, treatment (therapeutic), monitoring physiological measurements, or for health analytical purposes.

If the device has gone through the FDA’s Premarket Review Process (510K Certification) or, If it is incorporated as part of a medical device and, if modified, can have a negative impact on the functionality/safety of the main medical device http://en.wikipedia.org/wiki/Data

February 25, 2016 VA DIRECTIVE 6404 Appendix A

A1

Appendix A: VASI System Definition and System Identification Criteria

In order to effectively scope the inventory and establish enterprise wide agreement on the systems registered in VASI, an objective way to identify systems is required. Hence the following System Definition and System Identification Criteria (figure 1) are enacted.

Please refer to the VASI website for a higher resolution VASI System Identification Criteria. All new and existing VA IT capabilities that meet the following criteria shall be registered in VASI.

Figure 1 - VASI System Identification Criteria

VASI System: A VA Business Capability that: (1) Contains a combination of IT hardware, software, or information management capabilities; (2) Is funded and operationally managed by the VA; (3) Is hosted in a shared computing environment

(e.g., data center, cloud facility, medical center); (4) Is not an infrastructure or software sub-component (e.g., servers, network routers, storage) required to support a system and (5) Is not a Medical Device (e.g., cardiology equipment, medical lasers, endoscope) categorized under VA Medical Device Nomenclature System (MDNS) and governed by

Medical Device Isolation Architecture (MDIA) http://vaww.ea.oit.va.gov/enterprise-architecture/va-systems-inventory/

Appendix B: VASI Implementaion Sources

VASI is accessible at the VA internal URL http://vaww.ea.oit.va.gov/enterprise-architecture/va-systems-inventory/

VASI on-line application provides;

VA wide visibility of VA IT System attributes dependencies, capabilities and underlying IT assets

Data management capabilities to support system registrations and system attribute updates

Reporting and visualization capabilities for the VASI data

An accompanying document to this directive titled “VASI Handbook” is also available at the above URL which provides implementation details for this directive including access and operational procedures on how the VASI stakeholders will use the VASI on-line features.